From: hoz@univel.telescan.com (rick hoselton)
Date: Mon, 31 Jul 95 20:07:13 PDT
To: warlord@MIT.EDU (Derek Atkins)
Subject: hunting for no hole in PGP
Message-ID: <9508010307.AA21546@toad.com>
MIME-Version: 1.0
Content-Type: text/plain


>How do you propose that a user's keystrokes can be analyzed? 
        
I have an idea. (many voices groaning...)  The "reduced keyspace" 
and the "subliminal channels" fear both come from the mysterious 
process of choosing the 128-bit IDEA key. The other bogeyman that 
I hear the most about in PGP is the public/private  key generation.  
Random numbers scare people, including me.

Could PGP use and IDEA key that is the MD5 hash of the "random number" 
(the way it is currently calculated) concatenated with the message 
itself?  It would be easy to verify that the correct key had been selected.  
It would be impossible for some "ghost" in the random number routines 
to use a predictably reduced keyspace, or to send subliminal data, 
because its output never (directly) gets sent.  Something similar could 
be done during public/private key generation.

Have the PGP folks considered doing something similar?  Sometimes 
this seems like a good idea to me, and other times it looks like 
useless effort and one more opportunity for something to go wrong.






 
Rick F. Hoselton  (who doesn't claim to present opinions for others)