Re: [IDEA] Cypherpunks Super Computer (was Re: The Upcoming DES Challenge)

[Sorry if this is a re-post...]

From: "Frank O'Dwyer" <fod@brd.ie>
> However, what if there was a safe scripting language with bignum
> arithmetic and other cryptographic primitives, and what if
> lots of people ran a service that would accept scripts in 
> that language and respond with the answer?  Say, a Safe-TCL 
> interface to Peter Gutmann's cryptlib, running at idle 
> priority?  Sort of like a distributed batch queue, and also 
> a bit like the way jobs are (were?) submitted to Crays.  The 
> Cypherpunks Super Computer. It need not be significantly slower 
> than raw code if the primitives are high level enough.

A few years ago I coded up a TCL interface to Pr0duct Cypher's
PGPTOOLS library.  It did bignum arithmetic from the command line,
and also let you use MD5 and IDEA on files and buffers.  Unfortunately
I had a major disk crash and was never able to recover my last version,
and I never got back to it.

Safe-TCL has never gotten the scrutiny of Java, but IMO if it ever
does it will be found to suffer from its own flaws.  At this point
I think Java is farther along the path to safety.

I do like the idea of a widely available, installed, crypto-capable
scripting language.  This would be an ideal basis for trying out new
crypto protocols and algorithms, without having to write a whole program
from scratch.  We have been talking about setting up DC nets for years,
for example.  The concept is so simple as to be almost trivial.  But
the infrastructure is the hard part - dealing with the I/O issues, the
multiple architectures, all the configuration issues.

I suspect that Java, when it gets its security API, may be a good
candidate for this kind of system.  It's already got high level socket
I/O, and with a bignum package and some basic crypto primitives like
one way functions, you could do a lot with it.  You still have the
problem of trading off safety for utility, though.

Hal

[...] 
> I suspect that Java, when it gets its security API, may be a good
> candidate for this kind of system.  It's already got high level socket
> I/O, and with a bignum package and some basic crypto primitives like
> one way functions, you could do a lot with it.  You still have the
> problem of trading off safety for utility, though.

I like Java too, however it is getting to be a systems programming
language.  In my experience people are irrationally scared of it, too
(while happily tapping their secrets into MS-word, of course :-)

What I have in mind is more obviously restricted, and more like a 
programmable calculator (with bignums and buttons marked "DES") - no
sockets, no files, no system calls, etc.  Just number-crunching.
 
I take the point about Safe-TCL, but there must be some way of doing
this in a way that enough people think it's safe to run. 

Cheers,
Frank O'Dwyer.

At 12:15 PM -0800 1/9/97, Hal Finney wrote:
>I suspect that Java, when it gets its security API, may be a good
>candidate for this kind of system.  It's already got high level socket
>I/O, and with a bignum package and some basic crypto primitives like
>one way functions, you could do a lot with it.  You still have the
>problem of trading off safety for utility, though.

More of security API has hit the web site.  Java 1.1 has some crypto
primitives (exportable).  I also think it has a bignum package (but I am
not in a good position to check right now).  Info and download a few links
away from <http://java.sun.com>.


-------------------------------------------------------------------------
Bill Frantz       | Client in California, POP3 | Periwinkle -- Consulting
(408)356-8506     | in Pittsburgh, Packets in  | 16345 Englewood Ave.
frantz@netcom.com | Pakistan. - me             | Los Gatos, CA 95032, USA