🚀 go-pugleaf

In article <1992Sep28.202620.25342@linus.mitre.org>, lewis@aera8700.mitre.org (Keith Lewis) writes:
>PGP is essentially RSA performed on a bitmask which is used repeatedly on
>a single message. 

Oops!  After being corrected via email, I re-read the PGP documentation.  It
seems PGP is RSA performed on a randomly generated conventional cipher key,
But that conventional cipher is not a simple bitmask.  Here's an excerpt
from pgpdoc2.doc:

     As described earlier, PGP "bootstraps" into a conventional single-key
     encryption algorithm by using a public key algorithm to encipher the
     conventional session key and then switching to fast conventional
     cryptography.  So let's talk about this conventional encryption
     algorithm.  It isn't the DES.
      
     The Federal Data Encryption Standard (DES) is a good algorithm for
     most commercial applications.  However, the Government does not trust
     the DES to protect its own classified data.  Perhaps this is because
     the DES key length is 56 bits, short enough for a brute force attack
     with a special purpose machine built from massive numbers of DES
     chips.  Also, Biham and Shamir have had some success recently on
     attacking the full 16-round DES.
      
     PGP does not use the DES as its conventional single-key algorithm to
     encrypt messages.  Instead, PGP uses a different conventional
     single-key block encryption algorithm, called IDEA(tm).  A future
     version of PGP may support the DES as an option, if enough users
     ask for it.  But I suspect IDEA is better than DES.
      
     For the cryptographically curious, the IDEA cipher has a 64-bit block
     size for the plaintext and the ciphertext.  It uses a key size of 128
     bits.  It is based on the design concept of "mixing operations from
     different algebraic groups".  It runs much faster in software than
     the DES.  Like the DES, it can be used in cipher feedback (CFB) and
     cipher block chaining (CBC) modes.  PGP uses it in 64-bit CFB mode.
      
     The IPES/IDEA block cipher was developed at ETH in Zurich by James L.
     Massey and Xuejia Lai, and published in 1990.  This is not a 
     "home-grown" algorithm.  Its designers have a distinguished
     reputation in the cryptologic community.  Early published papers on
     the algorithm called it IPES (Improved Proposed Encryption Standard),
     but they later changed the name to IDEA (International Data
     Encryption Algorithm).  So far, IDEA has resisted attack much better
     than other ciphers such as FEAL, REDOC-II, LOKI, Snefru and Khafre. 
     And preliminary evidence suggests that IDEA may be more resistant
     than the DES to Biham & Shamir's highly successful differential
     cryptanalysis attack.  Biham and Shamir have been examining the IDEA
     cipher for weaknesses.  Academic cryptanalyst groups in Belgium,
     England, and Germany are also attempting to attack it, as well as the
     military services from several European countries.  As this new
     cipher continues to attract attack efforts from the most formidable
     quarters of the cryptanalytic world, confidence in IDEA is growing
     with the passage of time.
     
Keith Lewis             klewis@mitre.org          "Mr. Cheap"
I don't dance to music; music dances to me.  Email me for my PGP key.
The above may not (yet) represent the opinions of my employer.