Relay-Version: version B 2.10 5/3/83; site utzoo.UUCP
Path: utzoo!mnetor!seismo!lll-crg!nike!ucbcad!ucbvax!wisdom.bitnet!simsong
From: simsong@wisdom.bitnet (Simson L. Garfinkel)
Newsgroups: net.crypt
Subject: Re: randomly adding bits/bytes
Message-ID: <8608042018.AA04376@ucbjade.Berkeley.Edu>
Date: Tue, 5-Aug-86 06:45:41 EDT
Article-I.D.: ucbjade.8608042018.AA04376
Posted: Tue Aug  5 06:45:41 1986
Date-Received: Tue, 5-Aug-86 23:18:45 EDT
Sender: daemon@ucbvax.BERKELEY.EDU
Organization: University of California at Berkeley
Lines: 38

"Randomly" adding bits or bytes to the cyphertext is a fine way to
make a cypher harder to read. Most people don't want to do it, though.
I'm not sure why, but its bad form for an encryption system to
increase the length of its message -- possibly because that limits the
transmission bandwidth over channels which are possibly already very
slow.  (Somebody care to give the real reason?)

There are other ways of making a message difficult to decrypt. Perhaps
the best is to use a space-compression program on it first. When
decrypting a message, people (and computers) take advantage of
redundancy (sp?) in a file -- the same redundancy which space
compression programs remove. Using compress(1) before using crypt(1) or
a DES-based system is an excellent idea, as long as the person at the
other ends knows to uncompress(1) the message afterwards.

(By the way, speaking of crypt(1) -- its been terribly broken. There's
a program at MIT by Bob Baldwin that breaks even small samples of
crypt(1) generated cyphertext. Don't use crypt(1))

Both of the above systems for making a encrypted message harder to
decode -- randomly adding information and compressing the message
first -- are classified under modifying the encryption algorythim.
Whenever using a crypto-system, you've got to assume that the bad guy
is in posession of the entire algorythim and the complete cypthertext.
The trick is to make the encryption good enough that, as long as the
key is unknown, it is not possible to decrypt the file.

We "believe" that DES does this, although nobody knows for sure
(nobody that is allowed to tell, that is).

Using pseudorandom number generators for encryption is another
interesting idea. I wrote an article on that once, a long time ago,
but it was never published (to my knowledge). There are more secure
systems, however.

                        Simson L. Garfinkel
                        MIT Media Lab
                        Summer: Weizmann Institute of Science, Israel