Other Directory Sites: SeekWonder | Directory Owners Forum
The following archive was created by hippie-mail 7.98617-22 on Fri Aug 21 1998 - 17:18:27 ADT
Marcus Watts (mdw@umich.edu)
Mon, 08 Jun 98 21:00:14 -0400
Mike Stay writes:
...
(quoting from web site):
> "Design Automation has developed the most secure file encryption
> software package available.CyberLock uses five patented encryption
> enhancement technologies that make the software product very secure and
> fast.
>
> "CyberLock uses the 56-bit DES PRNG engine, then adds two further layers
> of encryption enhancement, Random Coding and Random Transposition. The
> result is a constantly changing, virtually impregnable defense of your
> data.
...
Mike Stay's own words:
> 1) What, exactly, is "encryption enhancement"?
> 2) Since when is DES a pseudorandom number generator?
> 3) How do you "drastically improve speed and security" for RC4?
> 4) All of the eight links on the page point to the same document (the
> one quoted.)
>
> I'd steer clear of this one.
I found 2 of the patents. First chance I had to explore
www.patents.ibm.com. (Neat resource! Kudos to ibm!) The
patent #'s I found were:
5533128
5113444
there appear to be more patents that reference these 2, which
appear to be of a similar ilk. I'm not at all sure any of
these patents would stand up to a real court case (they look
pretty obvious even to me). On the bright side of things,
at least this guy isn't trying to cloak his algorithm in NDA's,
so you got to give him some credit for honesty.
It's pretty easy to use DES (or whatever) as a PRNG. Just pick
your favorite random "seed" key, then ECB encrypt "0,1,2,3,4,5,6,7...".
Voila! Cheap and really slow random number generator.
Actually, MIT's kerberos 5 uses DES as a PRNG, in very much this way,
to generate "random" session keys (well, actually, they use cbc mode).
There is a somewhat elaborate way to generate the key based on the time of
day, pid, and "other information". I haven't dug through the code enough
yet to decide how good the "other information" is. There is also stuff
intended to generate 112 bit keys. I think that logic may be broken in
1.0, and may be one of many reasons they didn't release working des3 code
in that version.
I'm getting more of fond of using RC4 for small amounts of
non-cryptographic random number generation, because it's fast,
generates conveniently reproducible results even across different
architectures, and beats having to figure out whether "random" is
in ucblib, libbsd.a, or someplace else.
-Marcus Watts
UM ITD PD&D Umich Systems Group
The following archive was created by hippie-mail 7.98617-22 on Fri Aug 21 1998 - 17:18:27 ADT