Re: a hole in PGP

At 6:53 PM 7/31/95, Dr. Fred said:
>        Why (specifically) do you think the MIT version of PGP has no
>backdoors and is not subject to attacks such as the one outlined in my
>previous posting?

<Metzger_mode("on")>

I've been watching this gark long enough, I think.

Look. If you're qualified, look at the PGP source and vet it yourself. If
you aren't qualified, figure the market to be efficient in this instance
and assume the stuff works.

Stop wasting our time and bandwidth harassing the MIT folk about whether or
not their code is clean. Such posturing won't wash around here.

<Metzger_mode("off")>

Seriously, it may be an appeal to authority, but it can safely be assumed
that PGP is clean, and that MIT is *not* involved with the NSA and the Red
Leptons in a conspiracy to spy on our alt.binaries.pictures.erotica.stoats
postings.

Cheers,
Bob Hettinga


-----------------
Robert Hettinga (rah@shipwright.com)
Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131
USA (617) 323-7923
"Reality is not optional." --Thomas Sowell
>>>>Phree Phil: Email: zldf@clark.net  http://www.netresponse.com/zldf <<<<<

> 
> At 6:53 PM 7/31/95, Dr. Fred said:
> >        Why (specifically) do you think the MIT version of PGP has no
> >backdoors and is not subject to attacks such as the one outlined in my
> >previous posting?
> 
> <Metzger_mode("on")>
> 
> I've been watching this gark long enough, I think.
> 
> Look. If you're qualified, look at the PGP source and vet it yourself. If
> you aren't qualified, figure the market to be efficient in this instance
> and assume the stuff works.

One of the several points I tried (apparently unsuccessfully) to make is
that with a program that large, it is impractical to verify that there
are no subtle back doors - regardless of how knowledgeable or skilled
you or I may be.  Your "assumption of security" perspective is an
inappropriate one unless you are trying to get people to use something
that is not secure. 

> Stop wasting our time and bandwidth harassing the MIT folk about whether or
> not their code is clean. Such posturing won't wash around here.

The headers on the postings allow you to ignore them, but in the
meanwhile, the subject matter is in line with this forum, and the
questions are legitimate.  You will have to do better than to appeal to
authority to convince anyone that MIT's version of PGP is secure.

> <Metzger_mode("off")>
> 
> Seriously, it may be an appeal to authority, but it can safely be assumed
> that PGP is clean, and that MIT is *not* involved with the NSA and the Red
> Leptons in a conspiracy to spy on our alt.binaries.pictures.erotica.stoats
> postings.

Why (specifically) do you think so? Because you claim it? Because the
MIT maintainer claims it? You say MIT is not associated with the NSA,
but they have historically been funded by the NSA and other federal
agencies for work on information security.  Do you really think that the
only information protected by PGP is dirty pictures? Do you somehow
think that MIT and the NSA are above that sort of thing? All you have to
do is look at history, and it should be clear that this appeal to
authority is often used by those trying to cover things up.  If you know
something about PGPs security that you aren't telling us, don't beat
around the bush about it.  Come out and say it.  Tell us that you have
proven that PGP has no backdoors and what method you used to do that. 
Tell us that you have hand verified all the code and that none of it
overwrites the key generation process and tell us how you verified it.

It cannot be safely assumed that any program is clean or that any one
person or group is not involved with intentionally subverting security.
That violates the fundamental principles of information protection.

-- 
-> See: Info-Sec Heaven at URL http://all.net
Management Analytics - 216-686-0090 - PO Box 1480, Hudson, OH 44236

...
>> Look. If you're qualified, look at the PGP source and vet it yourself. If
>> you aren't qualified, figure the market to be efficient in this instance
>> and assume the stuff works.
>
>One of the several points I tried (apparently unsuccessfully) to make is
>that with a program that large, it is impractical to verify that there
>are no subtle back doors - regardless of how knowledgeable or skilled
>you or I may be.  Your "assumption of security" perspective is an
>inappropriate one unless you are trying to get people to use something
>that is not secure. 
>

It's true that, in general, the "burden" of demonstrating whether a
system is secure should fall primarily on those who claim it is rather
than on those who claim it isn't.  It's also true that PGP, for
whatever reason, is treated with a degree of reverence that is,
perhaps, unwarranted.  I, for one, would be much happier to see
greater vetting of widely-used programs like PGP.  But that does not
mean that one can expect to be taken seriously by simply throwing
darts and seeing where they land.  That would mean that essentially no
hardware, software, algorithm or protocol could ever be considered
trustworthy by anyone for any purpose.  There is a difference between
raising specific concerns and making vague, wild, unsupported claims,
which is how what you wrote below reads to me.

>> Stop wasting our time and bandwidth harassing the MIT folk about whether or
>> not their code is clean. Such posturing won't wash around here.
>
>The headers on the postings allow you to ignore them, but in the
>meanwhile, the subject matter is in line with this forum, and the
>questions are legitimate.  You will have to do better than to appeal to
>authority to convince anyone that MIT's version of PGP is secure.
>
>> <Metzger_mode("off")>
>> 
>> Seriously, it may be an appeal to authority, but it can safely be assumed
>> that PGP is clean, and that MIT is *not* involved with the NSA and the Red
>> Leptons in a conspiracy to spy on our alt.binaries.pictures.erotica.stoats
>> postings.
>
>Why (specifically) do you think so? Because you claim it? Because the
>MIT maintainer claims it? You say MIT is not associated with the NSA,
>but they have historically been funded by the NSA and other federal
>agencies for work on information security.  Do you really think that the
>only information protected by PGP is dirty pictures? Do you somehow
>think that MIT and the NSA are above that sort of thing? All you have to
>do is look at history, and it should be clear that this appeal to
>authority is often used by those trying to cover things up.  If you know
>something about PGPs security that you aren't telling us, don't beat
>around the bush about it.  Come out and say it.  Tell us that you have
>proven that PGP has no backdoors and what method you used to do that. 
>Tell us that you have hand verified all the code and that none of it
>overwrites the key generation process and tell us how you verified it.
>

No one knows how "prove" anything substantial, much less the absence
of backdoors, for anything but the most trivial software and
algorithms.

>It cannot be safely assumed that any program is clean or that any one
>person or group is not involved with intentionally subverting security.
>That violates the fundamental principles of information protection.

Your attempt to cast a near-defamatory shadow of suspicion over the
individuals and institutions who wrote the software, without raising
even a single specific concern about something you've observed about
the code, invites more questions about your own motives than those of
MIT or its staff.  It seems reasonable to ask you to put up or shut
up.

-matt

Disclaimer: I also give away cryptographic source code, in connection
with my job as a research scientist for a company that has even closer
ties to the spook community than you seem to think MIT has...

...
> It's true that, in general, the "burden" of demonstrating whether a
> system is secure should fall primarily on those who claim it is rather
> than on those who claim it isn't.  It's also true that PGP, for
> whatever reason, is treated with a degree of reverence that is,
> perhaps, unwarranted.  I, for one, would be much happier to see
> greater vetting of widely-used programs like PGP.

Excellent assessment - I wholely agree with it.

>  But that does not
> mean that one can expect to be taken seriously by simply throwing
> darts and seeing where they land.  That would mean that essentially no
> hardware, software, algorithm or protocol could ever be considered
> trustworthy by anyone for any purpose.  There is a difference between
> raising specific concerns and making vague, wild, unsupported claims,
> which is how what you wrote below reads to me.

A reasonable response.  My question is: Why do you think that the key
generation algorithm used by PGP is secure? Specifically, how do we know
there is no subtle back door that reduces the problem of testing the
typical key space to a solvable problem in today's technology?

I don't believe I made ANY "vague, wild, unsupported claims" however,
that is certainly a matter of opinion.

...
> >Why (specifically) do you think so? Because you claim it? Because the
> >MIT maintainer claims it? You say MIT is not associated with the NSA,
> >but they have historically been funded by the NSA and other federal
> >agencies for work on information security.  Do you really think that the
> >only information protected by PGP is dirty pictures? Do you somehow
> >think that MIT and the NSA are above that sort of thing? All you have to
> >do is look at history, and it should be clear that this appeal to
> >authority is often used by those trying to cover things up.  If you know
> >something about PGPs security that you aren't telling us, don't beat
> >around the bush about it.  Come out and say it.  Tell us that you have
> >proven that PGP has no backdoors and what method you used to do that. 
> >Tell us that you have hand verified all the code and that none of it
> >overwrites the key generation process and tell us how you verified it.
> 
> No one knows how "prove" anything substantial, much less the absence
> of backdoors, for anything but the most trivial software and
> algorithms.

Excellent - have you looked at the white paper describing the secure
"get-only" W3 server available under What's New at http://all.net? I
think that this is a step in the right direction toward demonstrating
more about a program than that it runs most of the time and seems to
give reasonable answers.  Perhaps someone would like to make similar
demonstrations for PGP.

> >It cannot be safely assumed that any program is clean or that any one
> >person or group is not involved with intentionally subverting security.
> >That violates the fundamental principles of information protection.
> 
> Your attempt to cast a near-defamatory shadow of suspicion over the
> individuals and institutions who wrote the software, without raising
> even a single specific concern about something you've observed about
> the code, invites more questions about your own motives than those of
> MIT or its staff.  It seems reasonable to ask you to put up or shut
> up.

Under what analysis do you construe "It cannot be safely assumed" as
"near-defamatory"?

I don't know you any more than you know me.  We are both just mail
sources on the Internet.  Why do you consider it reasonable to assume
that we should all trust statements made by people we do not know and
have not met based on their assertion that they think a cryptosystem is
safe and free of back doors?  If I add a PGP signature, does it make
me any more trustworthy?

> Disclaimer: I also give away cryptographic source code, in connection
> with my job as a research scientist for a company that has even closer
> ties to the spook community than you seem to think MIT has...

And I should trust you to tell me that PGP is safe for me to use?

-- 
-> See: Info-Sec Heaven at URL http://all.net
Management Analytics - 216-686-0090 - PO Box 1480, Hudson, OH 44236

>A reasonable response.  My question is: Why do you think that the key
>generation algorithm used by PGP is secure? Specifically, how do we know
>there is no subtle back door that reduces the problem of testing the
>typical key space to a solvable problem in today's technology?
>

I never said that I thought that PGP (or anything else) is "secure."
But to the extent that I do trust it for any given purpose, it is for
approximately the same reasons that I trust lots of other things that
I rely on.  I've spot checked some of the code - far from an
exhaustive analysis - and I've yet to discover anything myself that
points to any specific weakness.  I assume that others have done the
same, and I also assume that someone like me who did discover a
weakness would be likely, as I would be, to publish it and that
therefore I'd hear about it.  This is, for better or for worse, about
as much as can be said for almost anything in the cryptographic world.
Far from perfect, to be sure, but hardly unusual or unique to PGP.

...

>Under what analysis do you construe "It cannot be safely assumed" as
>"near-defamatory"?

Because you seem to be pointing a finger at specific people.  Your
recent messages imply (to me, at least) that you think one or more
members of the MIT PGP project may have deliberately tampered with
some of the PGP code.  You think the risk of this sort of thing having
occurred is especially great - greater than with other products, in
fact - with MIT PGP because of some (unspecified) connection you
believe MIT has with NSA.  (If I am mistaken here and you don't think
MIT PGP is at special risk, please clarify this - I suspect others got
the same impression).  PGP did not come from "MIT".  It came from
specific individuals who work there and who are named in the code and
documentation.  They have professional and personal reputations and
feelings just like we all do.  Some of these individuals are on or
close to this list.  To imply, without offering evidence, that these
people are somehow tainted and that their work should be especially
mistrusted is harmful and hurtful to them.  To use such implications
as the entire basis for claims about the security of or risks
associated with specific software does not move our understanding of
things forward.  Pointing out something specific, on the other hand,
would move things forward.  I think your "arguments" about this
subject so far have been vague, unscholarly, unprofessional,
needlessly personal, and just plain insulting.

-matt

> >Under what analysis do you construe "It cannot be safely assumed" as
> >"near-defamatory"?
> 
> Because you seem to be pointing a finger at specific people.  Your
> recent messages imply (to me, at least) that you think one or more
> members of the MIT PGP project may have deliberately tampered with
> some of the PGP code.

I don't believe I actually said any such thing.  Perhaps you are not
reading (or I am not writing) carefully enough.  All I think I did was
ask why I should believe they have not when they or those like them have
done it before. 

>  You think the risk of this sort of thing having
> occurred is especially great - greater than with other products, in
> fact - with MIT PGP because of some (unspecified) connection you
> believe MIT has with NSA.  (If I am mistaken here and you don't think
> MIT PGP is at special risk, please clarify this - I suspect others got
> the same impression).

PGP is a product that is specifically disliked by the powers that be
because it provides free access to strong cryptography which is against
the public policy of the US government.  That means that people in that
same said government likely feel it is their duty to make certain that
they can still read PGP mail.

>  PGP did not come from "MIT".  It came from
> specific individuals who work there and who are named in the code and
> documentation.  They have professional and personal reputations and
> feelings just like we all do.  Some of these individuals are on or
> close to this list.  To imply, without offering evidence, that these
> people are somehow tainted and that their work should be especially
> mistrusted is harmful and hurtful to them.

I didn't mean to be hurtful, but I did and do mean to ask why we should
believe that PGP is secure.  Their blind faith is not adequate for the
level of trust being put in PGP - even if they are really sincere.

In terms of implication, I don't believe I implied any such thing.  I
only asked why we should trust them with our individual freedom.

>  To use such implications
> as the entire basis for claims about the security of or risks
> associated with specific software does not move our understanding of
> things forward.  Pointing out something specific, on the other hand,
> would move things forward.  I think your "arguments" about this
> subject so far have been vague, unscholarly, unprofessional,
> needlessly personal, and just plain insulting.

I obviously disagree, but I still haven't heard a single response along
the lines of "here's why we believe it is secure..." I have heard lots
of responses along the lines of "believe us or convince yourself..." and
"read a 'Request for Comments' and that explains it all", but those
leads have not panned out - so far, the RFC tells us that PGP is not
secure and the convince yourself argument holds no water.

The fact is, you seem to support the idea that PGP is secure without a
reasonable basis, and when pushed a bit harder, agree that it probably
is not secure. 

How is it "unscholarly, unprofessional, needlessly personal, and just
plain insulting" to question the idea that hundreds of thousands of
people are trusting their freedom to software that is probably not
secure? I think it is highly unprofessional to try to claim that PGP is
secure and to try to bolster that position by claiming that some
"Request for Comments" supports it when that same said RFC refutes it.

It has been my general impression that "scholarly" means, among other
things, questioning the status quo and finding out where the generally
accepted ideas break down.  I am a professional in the field of
information protection, and I consider it highly unprofessional in this
field to assume that systems are secure without ample evidence to
support it.

So far, I see no ample evidence to support the security of PGP's key
generation algorithm relative to the concerns I have expressed.  Those
concerns are fairly specific as far as I am concerned, but if you feel I
have to demonstrate a specific attack that works in order to question
the adequacy of protection, I think you have it backwards.

If the people at MIT feel personally insulted because I have questioned
their previously accepted ideas, it's just too bad.  I didn't say they
had bad breath or that they were arogant or that they were ugly, all I
said was that their professional opinions seem to lack adequate
foundation when subjected to scrutiny.  This is professional comment,
not a personal one. 

As far as the potential that they are working with the NSA to subvert
personal privacy, it is a potential, just as it is a potential that I am
working with the NSA to undermine confidence in PGP.  The issue is and
should be, why (specifically) do you believe that PGP is secure.

This is how professionals deal with these sorts of questions:

	If you do not believe it is secure, you should say why not.

	In my case, I question its security and have given at least one
	example of how it could be insecure.

	If you do believe it is secure, you should be able to support
	your contention with more than reference to RFCs, vague
	comments, and claiming that you have read the code and didn't
	catch anything.

	If you cannot specifically address my question, say so, tell us
	all that the security of PGP is an open question, and either
	leave it open or go after closing it.

	OR come up with another alternative that doesn't ignore my question,
	doesn't avoid the issue, doesn't appeal to authority that fails to
	adequately support your contentions, and doesn't claim that I an
	somehow unprofessional or scholarly for questioning an unproven
	contention.

-- 
-> See: Info-Sec Heaven at URL http://all.net
Management Analytics - 216-686-0090 - PO Box 1480, Hudson, OH 44236

>> >Under what analysis do you construe "It cannot be safely assumed" as
>> >"near-defamatory"?
>> 
>> Because you seem to be pointing a finger at specific people.  Your
>> recent messages imply (to me, at least) that you think one or more
>> members of the MIT PGP project may have deliberately tampered with
>> some of the PGP code.
>
>I don't believe I actually said any such thing.  Perhaps you are not
>reading (or I am not writing) carefully enough.  All I think I did was
>ask why I should believe they have not when they or those like them have
>done it before. 

This speaks for itself.  "They or those like them," indeed!

...

>
>The fact is, you seem to support the idea that PGP is secure without a
>reasonable basis, and when pushed a bit harder, agree that it probably
>is not secure. 
>

I never made any claim that PGP is "secure".  Quite the contrary -
I've been complaining about the security implications of PGP's
monolithic structure and complexity since I first saw the code, though
I did state the basis on which I trust it little less than I trust
other software of equal complexity.  Primarily, however, I jumped in
to this discussion to take issue with your unfair implication that
there is reason to suspect deliberate wrongdoing on the part of the
MIT people.  If your remarks are based on some specific information
you know about some person or group, please tell us.  Otherwise, it
would be a shame allow your credibility to taint these people in the
backs of people's minds just for the sake of a casual, throwaway
rhetorical device.  There is no need to raise the specter of an evil
conspiracy to make your point.  It's irrelevant and beneath you, based
on what I've read of your earlier work on viruses.

Feel free to have the last word if you'd like, since we seem to AGREE
that PGP needs more analysis and scrutiny.

-matt

Hello fc@all.net (Dr. Frederick B. Cohen)
  and mab@crypto.com (Matt Blaze)
  and cypherpunks@toad.com

I'm afraid I missed the start of this thread, sorry if I'm repeating...

...
> The fact is, you seem to support the idea that PGP is secure without a
> reasonable basis, and when pushed a bit harder, agree that it probably
> is not secure. 

The problem is that "secure" is not really something that can be proved.
(I'm not sure if that's a theoretical or a practical fact, but it remains.)
For one thing, I'm not even sure the RSA algorithm itself is secure.
(At least I've never heard of a proof; have you?)

As long as I'm using PGP to send letters to grandma, the cost (to me) of
a successful attack is small. I therefore expend little effort to verify
that it is secure.

If/when I start to use it for more serious applications, I will read 
the source code. I might even modify it (eg. accord less entropy per
keystroke) if I'm not happy with it.

If circumstances warranted, I could re-implement it from the appropriate
RFC (is it out yet or still draft?). However, in such circumstances,
I very much suspect a one-time-pad would be used.

> This is how professionals deal with these sorts of questions:
> 
> 	If you do not believe it is secure, you should say why not.

I do not believe that it can be proven secure.

> 	In my case, I question its security and have given at least one
> 	example of how it could be insecure.

If you doubt the key-gen routine:
  * you are certainly free to make up your own keys any way you like,
  * write your own and argue that it's better, and/or
  * find a way to break the key-gen routine.

> 	If you do believe it is secure, you should be able to support
> 	your contention with more than reference to RFCs, vague
> 	comments, and claiming that you have read the code and didn't
> 	catch anything.

Adding to the list:
  * I've never heard of anyone catching anything (except the headers on
clearsigned messages problem).

> 	If you cannot specifically address my question, say so, tell us
> 	all that the security of PGP is an open question, and either
> 	leave it open or go after closing it.

The security of anything is an open question.

You shouldn't spend more on proving security than a breach would cost.


Hope I'm making sense...

Jiri
--
If you want an answer, please mail to <jirib@cs.monash.edu.au>.
On sweeney, I may delete without reading!
PGP 463A14D5 (but it's at home so it'll take a day or two)

This might seem a bit long, and I'd like to apologize to the real
cypherpunks for my ranting.

> > Because you seem to be pointing a finger at specific people.  Your
> > recent messages imply (to me, at least) that you think one or more
> > members of the MIT PGP project may have deliberately tampered with
> > some of the PGP code.
> 
> I don't believe I actually said any such thing.  Perhaps you are not
> reading (or I am not writing) carefully enough.  All I think I did was
> ask why I should believe they have not when they or those like them have
> done it before. 

You have.  I doubt it was intentional, but you have, continually.
Here are some snipets of things you've said.  First, you say that it
is a rational concern since PGP was taken over by us:

> The term paranoid is inappropriate in this context.  Paranoia refers to
> an irrational fear, while I am expressing a rational concern over a
> system that has been taken over by a (partially) government funded
> university and which has not been properly verified.  The history of
> cryptography (as they say) is (quite literally) littered with the dead
> bodies of people killed because somebody else thought a cryptosystem was
> good enough when it was not. 

Then you talk about the MIT version as if it were the original thing:

> 	Why (specifically) do you think the MIT version of PGP has no
> backdoors and is not subject to attacks such as the one outlined in my
> previous posting?

PGP 2.0 was released in September, 1992, from Europe, and many many
people have been examining it ever since.  I truly belive that there
are no backdoors.  Does that mean the program is completely bug-free?
Hardly.  Does it mean that some attack against PGP wont be discovered
in the future?  I dont know, I'm not a diviner, I cannot forsee the
future, and I have no idea what technology will come in the future.
For all I know, someone will prove that P=NP and all this will be for
naught.

Anyways, to get back to my claims of your hurtful statements:

> Why (specifically) do you think so? Because you claim it? Because the
> MIT maintainer claims it? You say MIT is not associated with the NSA,
> but they have historically been funded by the NSA and other federal
> agencies for work on information security.  Do you really think that the
> only information protected by PGP is dirty pictures? Do you somehow
> think that MIT and the NSA are above that sort of thing? All you have to
> do is look at history, and it should be clear that this appeal to
> authority is often used by those trying to cover things up.  If you know

I DO NOT GET PAID FOR ANY WORK I DO ON PGP!  I HAVE NEVER RECEIVED A
DIME FOR MY WORK.  I WORK ON PGP BECAUSE I BELIEVE IN IT.  Having said
that, I cannot BELIEVE you would have the Balls to say that the NSA
has bought me.  Go re-read what you've said.  You have just said that
the MIT PGP team, through MIT, is bound to be covering something up
because of historical fact.  

I have never said "Believe me when I said PGP is secure".  I have
continually asked for you to check on the security yourself.  But you
have continually refused to do that, and asked why it is secure!  So,
you refuse to look for yourself, and you refuse to believe it when you
are told.  So, what the hell do you want?  Do you want a line-by-line
examination of the code????  Sheesh!

> It cannot be safely assumed that any program is clean or that any one
> person or group is not involved with intentionally subverting security.
> That violates the fundamental principles of information protection.

You're right, which is why the source code is publically available.  I
would wholeheartedly agree with you if only binaries are shipped, but
the source is available.  Anyone can look through and verify the code.
Anyone can try to find weaknesses.  In fact, everyone is encouraged to
do so.  I don't see how _this_ "violates the fundamental principles of
information protection".

> You might be, but even if you are not, that doesn't mean there are no
> back doors.  Your inability to detect a backdoor gives me little
> confidence, since this is at least an NP-complete problem and, with all
> due respect, today, nobody can prove that PGP is free of backdoors

I think I've finally figured out where you are completely confused!!!
You are confusing "back door" with "bug".  FYI: A back door is usually
a means to make it easy for someone to get into a system.  For
example, if I put in code so that I could read every PGP message by
typing the passphrase "Setec Astronomy", that would be a backdoor.
The fact that httpd was exploitable, or sendmail holes, or etc. are
BUGS, not Back doors.

Your problem is that you are using these terms interchangably.  THEY
ARE NOT THE SAME.  Putting in a backdoor has the connotation of
intent.  A bug is an accidental occurrance that was a side effect of
poor coding, a typo, carelessness, confusion, inconsistency, etc.  A
back door, on the other hand, is a DELIBERATE ATTEMPT TO REDUCE OR
CIRCUMVENT SECURITY!

> "...Choosing random quantities to foil a resourceful and motivated
> adversary is surprisingly difficult.  ...recommends the use of truly
> random hardware techniques and shows that the existing hardware on many
> systems can be used for this purpose."
> 
> PGP does not use "truly random hardware techniques"

Oh?  It doesnt?  How can you say that?  In what way does it not do
this?  The RFC states, in your quote, that "existing hardware on many
systems can be used" for truly random hardware techniques.  Please,
substantiate your claim that PGP does not do this.  Show me code
segments which show it does not.  Show me an analysis that goes
contrary to the RFC.

> But the RFC acknowledges that these methods are highly suspect and should
> not be trusted.

You're right, it should not be blindly trusted.  Go read the code and
examine the algorithms to prove to yourself that it is secure.  I've
done that to the extent that I wish, and I believe it is secure.  But
you wont take my word for it, so go ahead and check!  Oh, wait, you
wont do that either.  Sorry.  I forgot.

> How is it "unscholarly, unprofessional, needlessly personal, and just
> plain insulting" to question the idea that hundreds of thousands of
> people are trusting their freedom to software that is probably not
> secure? I think it is highly unprofessional to try to claim that PGP is
> secure and to try to bolster that position by claiming that some
> "Request for Comments" supports it when that same said RFC refutes it.

Show me some proof that PGP is "probably not secure"?  Come on, there
is a finite probability that I can walk through a wall!  The laws of
quantum probablility give me this finite probability!  But I'd be hard
pressed to show you that I can walk through the wall.  It looks good
on paper, but it just ain't gonna happen.

As for the RFC, it does not refute that PGP is secure.  In fact, PGP
pretty much follows the RFCs guidelines.  You clearly have selective
reading.  A useful skill -- I should learn it.

> It has been my general impression that "scholarly" means, among other
> things, questioning the status quo and finding out where the generally
> accepted ideas break down.  I am a professional in the field of
> information protection, and I consider it highly unprofessional in this
> field to assume that systems are secure without ample evidence to
> support it.

Dont forget that you have to run PGP in some OS.  Please show me a
secure OS!  Given that the OS cannot be secure (using your logic it is
intuitively obvious that this is true) then how can you ask to see a
program any more secure than the enviornment in which it runs?  PGP
tries to be as secure as possible given the environment in which it is
being run.

> So far, I see no ample evidence to support the security of PGP's key
> generation algorithm relative to the concerns I have expressed.  Those
> concerns are fairly specific as far as I am concerned, but if you feel I
> have to demonstrate a specific attack that works in order to question
> the adequacy of protection, I think you have it backwards.

No, your concerns have been utterly vague.  The closest you've come to
being at all specific is some vague notion of analyzing keystrokes.
In every message I've responded to, I've asked you to expand upon what
you mean.  What kind of analysis do you mean?  How do you propose to
analyze keystroke timings?  Even if you have a probabalistic model of
keystroke timings, all you can possibly do is compare two different
probabilities to see if they are the same.  But that doesn't help you
limit the search on keys.

> If the people at MIT feel personally insulted because I have questioned
> their previously accepted ideas, it's just too bad.  I didn't say they

I'm not insulted that you are questioning PGP.  I am insulted because
in every message you have sent, you have postulated some conspiracy
with the government or postulated some intentional weakening of PGP.
Your statements could almost be construed as libelous, which is why I
feel insulted.  I feel extremely comfortable with people questioning
the security of PGP.  What I dont like is someone stating that it is
not secure, slaiming some sort of back door (which connotes some
intent to reduce the security) and does not back up the claim with any
proof.

> 	In my case, I question its security and have given at least one
> 	example of how it could be insecure.

And I've asked to you explain your conjecture, which you have
constantly either refused to do or intentionally ignored.

> 	If you do believe it is secure, you should be able to support
> 	your contention with more than reference to RFCs, vague
> 	comments, and claiming that you have read the code and didn't
> 	catch anything.

No matter what, PGP's security is based upon the security of RSA,
which in turn is based upon the difficult of factoring, which has
never been proven to be hard.  Therefore, there is always the
possibility that someone will find a polynomial factoring algorithm
which would completely destroy any security in PGP.

> 	If you cannot specifically address my question, say so, tell us
> 	all that the security of PGP is an open question, and either
> 	leave it open or go after closing it.

Ok.  Please explain what kind of keystroke timing analysis you
propose, and I will attempt to answer that, or concede your point.

> 	OR come up with another alternative that doesn't ignore my question,
> 	doesn't avoid the issue, doesn't appeal to authority that fails to
> 	adequately support your contentions, and doesn't claim that I an
> 	somehow unprofessional or scholarly for questioning an unproven
> 	contention.

Have you heard the thought experiment of putting a back-door in login
by modifying the C compiler to modilgy the C compiler to modify login?
Think about that in terms of the security of PGP -- you are always
going to be limited in security to the security of the system on which
you are running.

I only believe you are being unscholarly because you are making claims
without any supporting evidence.  _THAT_ is unscholarly!  

Now, if you are asking if PGP is completely bug free, I will be the
first to admit that it is not.  I am certain that there are latent
bugs in the code (and there are many that have been fixed since the
2.6.2 release).  However that has not been your statement nor your
questions.  You have asked about back doors, an intentional act to
reduce the security, and to that I vehemently say that there are none.

How do I know that you haven't been infected by a computer virus?
Perhaps there was a computer virus that flashed subliminal messages on
your screen to make you think you were L. Detweiler and think that
Desert Storm was the greatest thing since sliced bread?  Improbable?
Perhaps, but prove to me that this didn't happen!  How do you know
that Microsoft Windows doesn't send all your keystrokes to Bill Gates
for him to peruse?  Prove to me that we landed on the moon!  Some have
contended that it was all a hoax.  Prove to me that the universe
existed before I was concious of it.  How do I know that you exist?
Perhaps all this is a dream -- and if so, I sure hope to god I wake up
soon.

Good night.

-derek

RFC 1750 says:
# "...Choosing random quantities to foil a resourceful and motivated
# adversary is surprisingly difficult.  ...recommends the use of truly
# random hardware techniques and shows that the existing hardware on many
# systems can be used for this purpose."

Dr. Frederick B. Cohen writes:
$ PGP does not use "truly random hardware techniques"

I wrote:
% Correct.

Derek Atkins writes:
> Oh?  It doesnt?  How can you say that?  In what way does it not do
> this?  The RFC states, in your quote, that "existing hardware on many
> systems can be used" for truly random hardware techniques.  Please,
> substantiate your claim that PGP does not do this.  Show me code
> segments which show it does not.  Show me an analysis that goes
> contrary to the RFC.

Warning: I'm about to quibble over semantics. I'm not being accused of being
a NSA lackey (yet), so I guess I have more time for pettiness ;)

In the context of RFC 1750, it appears to me that the phrase "truly random
hardware techniques" does not refer to the type of RNG method employed in
PGP. Section 5.3 discusses the use of built-in digitizers of analog natural
sources, and turbulence in disk drive chambers, as the "truly random" 
"existing hardware" techniques. Keystroke timing only seems to fall under
6.2, Non-Hardware Sources of Randomness.

-----------------------------------------------------------------------
5.3 Existing Hardware Can Be Used For Randomness

   As described below, many computers come with hardware that can, with
   care, be used to generate truly random quantities.

5.3.1 Using Existing Sound/Video Input
[...]
5.3.2 Using Existing Disk Drives
[...]
-----------------------------------------------------------------------
6.2 Non-Hardware Sources of Randomness

   The best source of input for mixing would be a hardware randomness
   such as disk drive timing affected by air turbulence, audio input
   with thermal noise, or radioactive decay.  However, if that is not
   available there are other possibilities.  These include system
   clocks, system or input/output buffers, user/system/hardware/network
   serial numbers and/or addresses and timing, and user input. 
-----------------------------------------------------------------------

-Futplex <futplex@pseudonym.com>
"We love our lovin' -- but not like we love our freedom" -Joni Mitchell

Sorry for the long reply.  I hpe this will be taken off-line soon.

...
> Here are some snipets of things you've said.  First, you say that it
> is a rational concern since PGP was taken over by us:
> 
> > The term paranoid is inappropriate in this context.  Paranoia refers to
> > an irrational fear, while I am expressing a rational concern over a
> > system that has been taken over by a (partially) government funded
> > university and which has not been properly verified.  The history of
> > cryptography (as they say) is (quite literally) littered with the dead
> > bodies of people killed because somebody else thought a cryptosystem was
> > good enough when it was not. 

This is a true statement.  Tens of thousands of people have dies because
cryptosystems were trusted when they should not have been (hind sight
being 20/20 of course). 

> Then you talk about the MIT version as if it were the original thing:
> 
> > 	Why (specifically) do you think the MIT version of PGP has no
> > backdoors and is not subject to attacks such as the one outlined in my
> > previous posting?
> 
> PGP 2.0 was released in September, 1992, from Europe, and many many
> people have been examining it ever since.  I truly belive that there
> are no backdoors.

So you believe that there are no backdoors because it was released from
Europe and people have looked at it since.

...
> 
> Anyways, to get back to my claims of your hurtful statements:
> 
> > Why (specifically) do you think so? Because you claim it? Because the
> > MIT maintainer claims it? You say MIT is not associated with the NSA,
> > but they have historically been funded by the NSA and other federal
> > agencies for work on information security.  Do you really think that the
> > only information protected by PGP is dirty pictures? Do you somehow
> > think that MIT and the NSA are above that sort of thing? All you have to
> > do is look at history, and it should be clear that this appeal to
> > authority is often used by those trying to cover things up.  If you know
> 
> I DO NOT GET PAID FOR ANY WORK I DO ON PGP!  I HAVE NEVER RECEIVED A
> DIME FOR MY WORK.  I WORK ON PGP BECAUSE I BELIEVE IN IT.  Having said
> that, I cannot BELIEVE you would have the Balls to say that the NSA
> has bought me.  Go re-read what you've said.  You have just said that
> the MIT PGP team, through MIT, is bound to be covering something up
> because of historical fact.  

I think that you miss the point.  If you worked for the NSA, you would
probably say this as well.  The point is that, for the purposes of
looking at the security of PGP, we should assume that you have evil
intent, whether you do or not.

I didn't say that the NSA bought you.  I asked " Why (specifically)..."
The question mark at the end is a dead give-away.  It is factually
accurate that government agencies have gotten the cooperation of
academics in the past to carry out subversions in order to further their
goals.  I asked "Do you somehow think that MIT and the NSA are above
that sort of thing?"  You apparently do, but history tell us that it is
imprudent to do this.

So if there has been a failure in communications in this respect, I
appologize for not making it as clear as I might have.  If you feel
personally slighted, I am sorry that you feel this way.  Nevertheless, I
believe that it is prudent to believe that the NSA has "bought you" for
the purpose of assessing the security of PGP and to ask the question
"Why (specifically) do you think so?"

> I have never said "Believe me when I said PGP is secure".  I have
> continually asked for you to check on the security yourself.  But you
> have continually refused to do that, and asked why it is secure!  So,
> you refuse to look for yourself, and you refuse to believe it when you
> are told.

I have not refused to do any such thing.  I have had a copy of PGP for
quite some time, but it is too large and complex for me to verify by
hand, and I know of no automated technique that can do the job in any
reasonable amount of time.  I was probably wrong to assume that this was
obvious.

>  So, what the hell do you want?  Do you want a line-by-line
> examination of the code????  Sheesh!

I think it would be prudent to do and publish a line-by-line walkthrough
of the source of PGP (although not to the whole list please).  You
should be trying to prove properties such as the non-interference of any
of the rest of the code with the key generation (or other) algorithms. 
This may be done by an information flow analysis similar to what was
done on our secure W3 server.  It would also be prudent to perform
adequate tests of the properties of inputs from people to determine the
true information content of the seeds and to publish these results so
they can be critiqued.  Perhaps it would also be valuable to have the
members of this list contribute ideas about properties they think would
be worth verifying.

> > It cannot be safely assumed that any program is clean or that any one
> > person or group is not involved with intentionally subverting security.
> > That violates the fundamental principles of information protection.
> 
> You're right, which is why the source code is publically available.  I
> would wholeheartedly agree with you if only binaries are shipped, but
> the source is available.  Anyone can look through and verify the code.
> Anyone can try to find weaknesses.  In fact, everyone is encouraged to
> do so.  I don't see how _this_ "violates the fundamental principles of
> information protection".

The problem is that merely shipping however many lines of source code
does little to demonstrate its propriety.  A publicly posted version of
the source for IRC, for example, had an obvious Trojan horse that wasn't
detected for more than 6 months and was actively being used to attack
systems over the entire period.  In order to assess the source code, it
is necessary to also publish appropriate demonstrations of WHY it is
secure.
 
> > You might be, but even if you are not, that doesn't mean there are no
> > back doors.  Your inability to detect a backdoor gives me little
> > confidence, since this is at least an NP-complete problem and, with all
> > due respect, today, nobody can prove that PGP is free of backdoors
> 
> I think I've finally figured out where you are completely confused!!!
> You are confusing "back door" with "bug".  FYI: A back door is usually
> a means to make it easy for someone to get into a system.  For
> example, if I put in code so that I could read every PGP message by
> typing the passphrase "Setec Astronomy", that would be a backdoor.
> The fact that httpd was exploitable, or sendmail holes, or etc. are
> BUGS, not Back doors.

But don't you see? If I introduce a subtle backdoor and make it look
like a bug, I have plausible deniability.  Since I, as an independent
observer, cannot tell whether the hole is intentional or accidental, I
should, for the purposes of considering security, assume that it is
intentional. 

> Your problem is that you are using these terms interchangably.  THEY
> ARE NOT THE SAME.  Putting in a backdoor has the connotation of
> intent.  A bug is an accidental occurrance that was a side effect of
> poor coding, a typo, carelessness, confusion, inconsistency, etc.  A
> back door, on the other hand, is a DELIBERATE ATTEMPT TO REDUCE OR
> CIRCUMVENT SECURITY!

But how can I, as an independent observer, tell if it is an accident or
a cleaverly intentional subversion? I cannot look into your brain and
tell the difference, and no statement you make can reasonably convince
me.  They may not be the same, but they are not differentiable by an
independent observer.  From a scientific point of view, they are the
same.  From a humanistic point of view they may be different.

> > "...Choosing random quantities to foil a resourceful and motivated
> > adversary is surprisingly difficult.  ...recommends the use of truly
> > random hardware techniques and shows that the existing hardware on many
> > systems can be used for this purpose."
> > 
> > PGP does not use "truly random hardware techniques"
> 
> Oh?  It doesnt?  How can you say that?  In what way does it not do
> this?  The RFC states, in your quote, that "existing hardware on many
> systems can be used" for truly random hardware techniques.  Please,
> substantiate your claim that PGP does not do this.  Show me code
> segments which show it does not.  Show me an analysis that goes
> contrary to the RFC.

You have it backwards.  You show me that the techniques you claim to be
truely random are indeed that.  Supposedly random number generators have
been created for many years, and plenty of them have been broken after
many years of being held to be secure with the algorithm and the full
details available for all to see.

> > But the RFC acknowledges that these methods are highly suspect and should
> > not be trusted.
> 
> You're right, it should not be blindly trusted.  Go read the code and
> examine the algorithms to prove to yourself that it is secure.  I've
> done that to the extent that I wish, and I believe it is secure.  But
> you wont take my word for it, so go ahead and check!  Oh, wait, you
> wont do that either.  Sorry.  I forgot.

But I cannot prove that it is secure.  In fact, I believe that it is not!

> > How is it "unscholarly, unprofessional, needlessly personal, and just
> > plain insulting" to question the idea that hundreds of thousands of
> > people are trusting their freedom to software that is probably not
> > secure? I think it is highly unprofessional to try to claim that PGP is
> > secure and to try to bolster that position by claiming that some
> > "Request for Comments" supports it when that same said RFC refutes it.
> 
> Show me some proof that PGP is "probably not secure"?  Come on, there
> is a finite probability that I can walk through a wall!  The laws of
> quantum probablility give me this finite probability!  But I'd be hard
> pressed to show you that I can walk through the wall.  It looks good
> on paper, but it just ain't gonna happen.

That's exactly what the Germans said about the Enigma and others have
been saying about cryptosystems for the past 4,000+ years.  They have
been shown wrong again and again, and as a result, people like me want
more than just an "I believe it's secure".

> As for the RFC, it does not refute that PGP is secure.  In fact, PGP
> pretty much follows the RFCs guidelines.  You clearly have selective
> reading.  A useful skill -- I should learn it.

It takes years of practice.

> > It has been my general impression that "scholarly" means, among other
> > things, questioning the status quo and finding out where the generally
> > accepted ideas break down.  I am a professional in the field of
> > information protection, and I consider it highly unprofessional in this
> > field to assume that systems are secure without ample evidence to
> > support it.
> 
> Dont forget that you have to run PGP in some OS.  Please show me a
> secure OS!  Given that the OS cannot be secure (using your logic it is
> intuitively obvious that this is true) then how can you ask to see a
> program any more secure than the enviornment in which it runs?  PGP
> tries to be as secure as possible given the environment in which it is
> being run.

I agree that it is often easier to break into the computer to get the
keys than it is to break the cryptosystem.  That was my next bone to
pick with PGP - the way it stores the keys.  But I'll save that for
another day. 

> > So far, I see no ample evidence to support the security of PGP's key
> > generation algorithm relative to the concerns I have expressed.  Those
> > concerns are fairly specific as far as I am concerned, but if you feel I
> > have to demonstrate a specific attack that works in order to question
> > the adequacy of protection, I think you have it backwards.
> 
> No, your concerns have been utterly vague.  The closest you've come to
> being at all specific is some vague notion of analyzing keystrokes.
> In every message I've responded to, I've asked you to expand upon what
> you mean.  What kind of analysis do you mean?  How do you propose to
> analyze keystroke timings?  Even if you have a probabalistic model of
> keystroke timings, all you can possibly do is compare two different
> probabilities to see if they are the same.  But that doesn't help you
> limit the search on keys.

For example, you can generate the most probable 10^40 or so input
sequences, do key generation, and test against them to find out if the
user's key is one of them.  The question I am posing could be considered
as a question of the information content of the original input to PGP's
key generation process.

How could this be subtly altered by a person responsible for maintaining
PGP or detected and not repaired by same? For example, a loop index
could be calculated incorrectly by having a different part of PGP
overwrite the loop index using an incorrect ponter conversion.  Then the
loop that uses all of the input bits would be subtly altered so as to
use fewer of them.  The results would still look random but the total
search space would be reduced to the point where a good supercomputer
could run through it in only a few hours.

> > If the people at MIT feel personally insulted because I have questioned
> > their previously accepted ideas, it's just too bad.  I didn't say they
> 
> I'm not insulted that you are questioning PGP.  I am insulted because
> in every message you have sent, you have postulated some conspiracy
> with the government or postulated some intentional weakening of PGP.

And history tells us that the U.S.  government does this quite often. 
They are actively trying to harass PGP's author using a variety of what
could be reasonably called dirty tricks, they are actively trying to
prevent the use of good cryptography in the US, and they are actively
trying to make certain uses of cryptography illegal.  Why should I
believe that they would not also try to subvert PGP?

> Your statements could almost be construed as libelous, which is why I
> feel insulted.  I feel extremely comfortable with people questioning
> the security of PGP.  What I dont like is someone stating that it is
> not secure, slaiming some sort of back door (which connotes some
> intent to reduce the security) and does not back up the claim with any
> proof.

What I don't like is people that state it is secure but can't back it up
with real facts.  Why (specifically) do you believe PGP is secure?
Forget your ego and the posturing about how you are not working for the
NSA and come up with a really good demonstration of the reason PGP is
secure, and I will be very quick to commend you.

...
> Ok.  Please explain what kind of keystroke timing analysis you
> propose, and I will attempt to answer that, or concede your point.

Fair enough.  A useful first step would be to demonstrate the real
information content of the keystrokes and timings entered by the user
across a reasonable number of different platforms, users, and trials.
That would start to address the potential that there is a fundamental
mistake in (or intentional corruption of) the input process.

The demonstrations described earler would also be worthwhile in
demonstrating the lack of subtle interaction among the parts of PGP (I
refer to the information flow analysis).

After that, you should solicit other ideas from as wide an audience as
possible to see what sorts of properties should be considered for this
sort of program, and go about picking the most important ones first, and
so on.  I would be happy to discuss further details off-line.

> > 	OR come up with another alternative that doesn't ignore my question,
> > 	doesn't avoid the issue, doesn't appeal to authority that fails to
> > 	adequately support your contentions, and doesn't claim that I an
> > 	somehow unprofessional or scholarly for questioning an unproven
> > 	contention.
> 
> Have you heard the thought experiment of putting a back-door in login
> by modifying the C compiler to modilgy the C compiler to modify login?
> Think about that in terms of the security of PGP -- you are always
> going to be limited in security to the security of the system on which
> you are running.

Not a thought experiment, the Turing award paper in 1984 - came out just
a little bit after the IFIP conference in which computer viruses were
first publicly described and analyzed. 

> I only believe you are being unscholarly because you are making claims
> without any supporting evidence.  _THAT_ is unscholarly!

I think there is good supporting historical evidence for my questions.
But I don't believe I have made any "claims".

...

-- 
-> See: Info-Sec Heaven at URL http://all.net
Management Analytics - 216-686-0090 - PO Box 1480, Hudson, OH 44236

On Mon, 31 Jul 1995, Dr. Frederick B. Cohen wrote:

> A reasonable response.  My question is: Why do you think that the key
> generation algorithm used by PGP is secure? Specifically, how do we know
> there is no subtle back door that reduces the problem of testing the
> typical key space to a solvable problem in today's technology?

Well I told you that I verified the results of the key generation in PGP 
by testing the primality of p and q and the validity of the key by 
testing ed = 1 mod (p-1)(q-1).  That bit works, period.

You seem to be in some doubt about the random starting point for the prime
searching.  Entropy for the random number generator is collected from the
user's keystrokes and is mixed into the random pool.  PGP is very careful
about how much entropy it attaches to one keystroke and makes sure that
the user is prompted to press more keys if it thinks it has not got
enough.  The random pool is itself stirred periodically by using MD5 to
"encrypt" it.  This encryption is made strictly one way by using the first
64 bytes of the pool as the key, these 64 bytes are destroyed after use. 

Now, amongst other times the pool is stirred both before and after use.  
So, recovering any given state of the pool (i.e. finding the random 
starting point for a prime search) has to be equivalent to reversing the 
MD5 transform.  There is no known way to do this.


- Andy

+-------------------------------------------------------------------------+
| Andrew Brown  Internet <asb@nexor.co.uk>  Telephone +44 115 952 0585    |
| PGP (2048/9611055D): 69 AA EF 72 80 7A 63 3A  C0 1F 9F 66 64 02 4C 88   |
+-------------------------------------------------------------------------+

>A reasonable response.  My question is: Why do you think that the key
>generation algorithm used by PGP is secure? Specifically, how do we know
>there is no subtle back door that reduces the problem of testing the
>typical key space to a solvable problem in today's technology?
>
>I don't believe I made ANY "vague, wild, unsupported claims" however,
>that is certainly a matter of opinion.
>
	OK, let me put my 2 pence collaboration:

	Let's see. I can try to write a nice program to protect myself.
I could XOR something with my key (00000000) and use that. Then tell my
fellows and all of us use the same program.

	Or I could even be more tricky and implement something more complex.

	Now, my knowledge, time and resources are limited. I see that MIT
or whomever has made a program that, under test, is more secure than my
XOR 00000000 implementation. I may not fully trust them but it is better
than anything I could come out with.

	So, my position is: if it's the best thing I have access to, I only
have two options: either I use it or I give up with cryptography at all.
Right?

	Now, I think that what I am trying to say is: if you can come up
with something better, please do. All the Free (and Wannabe Free) World
will be eternally grateful to you. If you can't, then you only have the
above two options.

	Bragging about hypothetical fears that you can't demonstrate at all
is not only stupid, it is also pesimistic, destructive, improductive and
threatening all kinds of freedom. Nazi perhaps? Dunno. And I don't care.

	Security? As you have already been told, you can only prove it
negatively. So, since you can only prove that it can fail, but can't prove
it can't, any discussion is irrelevant unless you have any real proof.

	All the process is based in a fight against time: you are assuming
that nobody can break your crypto process before the secret becomes irrelevant.
All your security lies in the fact that *YOU* don't know of anybody that 
can break the problem but can't deny that  someone could ever possibly 
discover a clever algorithm.

	Thus: either you have proofs that it can be broken, or know a better
algorithm, or can name someone who can proof s/he can break it, or you just
trust it the best you can. Any other kind of discussion is a sophism.

	Dr?... hum. Let me try then a different analogy: I do have a patient
with a letal disease with no known therapy. Then someone comes up with A,
which cures people, but -being new- could maybe possibly perhaps have some
secondary effect that no one knows yet and can't be demonstrated (but could
exist). Now, should I trust the lifes of my patients to therapy A or should
I wait for some years to be secure it has no secondary effects?. Even so,
since the fact nobody has reported them doesn't mean it could not have
them (only that nobody has discovered them), I can't be 100% sure.

	Oh, well, I guess that if your doctor never gave you a therapy 'cos
you can never be 100% sure, you would not like the idea. Would you trust
your life to that therapy when you know for sure you are about to die if
you don't? What if A saved 100%, but there was a therapy B that saved 20%
with no known secondary effects either? Which one would you chose?

	Thus, can you trust lives and whatnot to something not fully known?
I'd say that unless you have something better, that's your better bet. So,
since you know for sure that if you don't use any cryptography at all, you
must communicate in the clear, what do you do?

	So, can you come up with something better or not?

				jr

From: fc@all.net (Dr. Frederick B. Cohen)
   Date: Mon, 31 Jul 1995 20:08:15 -0400 (EDT)

   One of the several points I tried (apparently unsuccessfully) to make is
   that with a program that large, it is impractical to verify that there

For better or for worse, we all must use programs (or collections
of programs) that large or larger: even if PGP could be implemented
in 1 % of the current source code, it would still be running in an
operating system that's cramped in 4 megabytes of ram, because that's
a characteristic of the common modern operating systems.

The operating systems PGP is running in are larger than PGP itself; if 
PGP is too large to practically verify the nonexistance of back doors,
then there's nothing we can do whatsoever to disprove the existance
of back doors.

...are no subtle back doors - regardless of how knowledgeable or skilled
   you or I may be.  Your "assumption of security" perspective is an
   inappropriate one unless you are trying to get people to use something
   that is not secure. 

Or unless you're trying to subject a program to a standard nothing
ever written these days is going to meet because it runs in an
operating system that's a lot harder to verify as being secure.

Please note: I am not trying to suggest that there are purposeful or
inadvertent back doors in any of the variants of PC-DOS, Windows, or
the Macintosh OS, or more than usual in the various Unix variants (of
which the details are available on RISKS; of course, Unix can probably
be made reasonably secure if one is aware of the issues involved,
which isn't a bad idea. This isn't meant to be a disendorsement of
Unix.)

   The headers on the postings allow you to ignore them, but in the
   meanwhile, the subject matter is in line with this forum, and the
   questions are legitimate.  You will have to do better than to appeal to
   authority to convince anyone that MIT's version of PGP is secure.

Can you _convince_ me that MacOS 7.5, or Windows 3.1 (the OS I
currently use), or WWG, or OS/2 3.0, or Linux, or NetBSD, is
reasonably secure?

   Why (specifically) do you think so? Because you claim it? Because the
   MIT maintainer claims it? You say MIT is not associated with the NSA,
   but they have historically been funded by the NSA and other federal
   agencies for work on information security.  Do you really think that the
   only information protected by PGP is dirty pictures? Do you somehow
   think that MIT and the NSA are above that sort of thing? All you have to
   do is look at history, and it should be clear that this appeal to
   authority is often used by those trying to cover things up.  If you know
   something about PGPs security that you aren't telling us, don't beat
   around the bush about it.  Come out and say it.  Tell us that you have
   proven that PGP has no backdoors and what method you used to do that. 
   Tell us that you have hand verified all the code and that none of it
   overwrites the key generation process and tell us how you verified it.

   It cannot be safely assumed that any program is clean or that any one
   person or group is not involved with intentionally subverting security.
   That violates the fundamental principles of information protection.

What OS should I use to do this? Should I just give up on anything
beyond TRS-DOS 6.2?

Phil

On Mon, 31 Jul 1995, Phil Fraering wrote:

> For better or for worse, we all must use programs (or collections
> of programs) that large or larger: even if PGP could be implemented
> in 1 % of the current source code, it would still be running in an
> operating system that's cramped in 4 megabytes of ram, because that's
> a characteristic of the common modern operating systems.

Ahem!  Commiedore APOLOGIED when it released its 512K OS a couple of 
years ago.  These things _don't_ have to be this large.

> The operating systems PGP is running in are larger than PGP itself;

Got that straight!

> which isn't a bad idea. This isn't meant to be a disendorsement of
> Unix.)

Oh, please!  Now that I'm back with my direct connection, I want another 
OS holy war!  I want to killfile LOTS of people (or two people in 
particular).

> What OS should I use to do this? Should I just give up on anything
> beyond TRS-DOS 6.2?

No!  Use UltraDos.  Much better!

Nathan

Now THAT's noise....

Nathan, I know about the Amiga's small OS; I have used them on and
off over the years and recently acquired a non-functional one that
I had repaired; it's at the repair shop in Houston, waiting for the
next time I'm able to go to Houston and pick it up.

I really didn't want to start an OS holy war, although personally my
recent experiences with Windows incline me towards joining the Linux
Inquisition.

Our main weapon is fear, fear and suprise! Our _two_ main weapons are
fear, suprise, and an almost fanatical devotion to the principles of
K & R C. OUR THREE main weapons are...

Hmm. Maybe I should come in again...

+----------------+Quote from _Infinite In All Directions_, F.J. Dyson-----+
| Phil Fraering / \"The English Hierarchy, if there be anything unsound in|
| pgf@tyrell.net\ /its constitution, has reason to tremble even at an air |
+----------------+-pump or an electrical machine."---Joseph Priestly------+

On Mon, 31 Jul 1995, Dr. Frederick B. Cohen wrote:

> Why (specifically) do you think so? Because you claim it? Because the
> MIT maintainer claims it? You say MIT is not associated with the NSA,
> but they have historically been funded by the NSA and other federal
> agencies for work on information security.  Do you really think that the

Of course MIT was in the NSA's pocket back in 1978 when they mailed me 
and 3,000 other people a copy of "A Proposal for a Public Key Encryption 
System" and started this whole Public Key-Private Key thing.  It was all 
part of a plot.  If they hadn't done that we might all be using stronger 
systems today.

DCF

On Tue, 1 Aug 1995, Duncan Frissell wrote:

> On Mon, 31 Jul 1995, Dr. Frederick B. Cohen wrote:
> 
> > Why (specifically) do you think so? Because you claim it? Because the
> > MIT maintainer claims it? You say MIT is not associated with the NSA,
> > but they have historically been funded by the NSA and other federal
> > agencies for work on information security.  Do you really think that the
> 
> Of course MIT was in the NSA's pocket back in 1978 when they mailed me 
> and 3,000 other people a copy of "A Proposal for a Public Key Encryption 
> System" and started this whole Public Key-Private Key thing.  It was all 
> part of a plot.  If they hadn't done that we might all be using stronger 
> systems today.

Sounds like another LD tentacle to me ;)
--
Ed Carp, N7EKG    			Ed.Carp@linux.org, ecarp@netcom.com
801/534-8857 voicemail			801/460-1883 digital pager
Finger ecarp@netcom.com for PGP 2.5 public key		an88744@anon.penet.fi

Q.	What's the trouble with writing an MS-DOS program to emulate Clinton?
A.	Figuring out what to do with the other 639K of memory.

On Tue, 1 Aug 1995, Duncan Frissell wrote:

> 
> 
> On Mon, 31 Jul 1995, Dr. Frederick B. Cohen wrote:
> 
> > Why (specifically) do you think so? Because you claim it? Because the
> > MIT maintainer claims it? You say MIT is not associated with the NSA,
> > but they have historically been funded by the NSA and other federal
> > agencies for work on information security.  Do you really think that the
> 
> Of course MIT was in the NSA's pocket back in 1978 when they mailed me 
> and 3,000 other people a copy of "A Proposal for a Public Key Encryption 
> System" and started this whole Public Key-Private Key thing.  It was all 
> part of a plot.  If they hadn't done that we might all be using stronger 
> systems today.

You forgot the NSA's most recent overt act in the PGP conspiracy:  it 
gets PGP declared a munition, harassing PZ, gets lots of bad press, etc., 
all in order to make Cypherpunks believe that there is no back door, when 
there really  is!

Shhhhhhhhh. Don't let on that you know.  Just go back to Rot-13 encoding.


> DCF


EBD

Date: Wed, 2 Aug 1995 02:09:25 -0400 (EDT)
   From: Brian Davis <bdavis@thepoint.net>

   You forgot the NSA's most recent overt act in the PGP conspiracy:  it 
   gets PGP declared a munition, harassing PZ, gets lots of bad press, etc., 
   all in order to make Cypherpunks believe that there is no back door, when 
   there really  is!

   Shhhhhhhhh. Don't let on that you know.  Just go back to Rot-13 encoding.

You forgot to mention that although PGP is "provably" secure, that the
NSA engine for breaking it is a quantum computer built with "borrowed"
extraterrestrial technology.

   > DCF


   EBD

P.S.: The Truth Is Out There.

PGP message