🚀 go-pugleaf

In article <n0e49t@ofa123.fidonet.org> Erik.Lindano@ofa123.fidonet.org writes:
>Writes lwloen@rchland.vnet.ibm.com (Larry Loen):
> 
> 
> > Moreover, in any real-world situation of any importance whatever, 
> > the algorithm WILL be known. 
> 
> You are absolutely wrong.
> 

Since you have decided to do some reading, check out the Codebreakers
by David Kahn.  It has plenty of examples of how algorithms are
discovered.  For instance, I suspect that your friend would disclose it
for one million dollars.  Therefore, the assumption that it will never
become known is almost certainly false.  If the program is distributed,
it can be easily reverse engineered.  I have reverse engineered programs
that did encryption in the past, including the internet worm, so I have
proof by example there.

> > Since we'd be providing a free service, shouldn't you show 
> > a little mercy?
> 
> Yes, and not only mercy, but even sympathy, and honest consideration 
> of, and gratefulness for, your skill and your interest. But please
> don't disappoint us by calling us names just because we offered a
> challenge to you! That's unworthy of professionals.

I hope that you do not think that I am calling you names.  I am trying
to explain the facts of cryptanalysis to you, but you are free to
believe whatever you want.

> 
> This here algorithm encrypts and decrypts reliably and 
> unambiguously, every time. It's kind of uncanny, considering what 
> it has to do to... oops! I may have said too much already.

:)

> 
> > It could even be a very good system . . . that was invented fifty 
> > years ago or is a trivial variation of one invented fifty years 
> > ago.  
> 
> Guaranteed not to have been invented fifty years ago. Promise.
> More like a new way of doing things. A new way of looking at things.
> Very intriguing and unusual. But blindingly fast! Absolutely 
> fascinating stuff. 

Well, seeing as we have not heard from your friend, there is no
way for us to judge whether he is up on the technology in the
field or not.  You have given us no indication that would suggest
that he is, and one that would suggest otherwise.

> 
> > Since you and your friend have so far not bothered to learn the 
> > subject, would you at least take our word for what constitutes a 
> > fair challenge?  It's more or less in my FAQ.  If your friend will 
> > not read it, could I ask you to do so?  You seem a fair-minded 
> > person; only a little knowledge would allow you to ask for what 
> > you wish much more sensibly.
> 
> This fairness business has a bearing on possible commercial use and,
> to that extent, I cannot abide by it for now. We don't want to 
> publish the algorithm at this time, but would like to see if its
> output is capable of resisting your analysis. For that purpose,
> we have simplified and even trivialized the challenge to the point
> where making it any easier would almost mean giving the solution 
> away.

Well, I have bad news for your friend.  It is fairly unlikely that
he will gain much by trying to commercialize his algorithm.  It is
much easier to convince somebody to buy a DES package, as you can
point to the fact that it is a government standard that has been
approved for safeguarding the banking data in the US.  Now, if it
does public key without infringing on the PK Partner patents, then
its a different story :-)

- Keith