Path: utzoo!mnetor!uunet!husc6!think!bloom-beacon!mit-eddie!fenchurch.mit.edu!jbs
From: jbs@fenchurch.MIT.EDU (Jeff Siegal)
Newsgroups: sci.crypt
Subject: Re: Unix Password Hacker
Message-ID: <8469@eddie.MIT.EDU>
Date: 14 Mar 88 01:05:39 GMT
References: <731@ddsw1.UUCP> <657@morningdew.BBN.COM> <1988Mar2.235819.18983@utzoo.uucp> <QWB54=y00Xo9Q3A1c3@andrew.cmu.edu>
Sender: uucp@eddie.MIT.EDU
Reply-To: jbs@fenchurch.MIT.EDU (Jeff Siegal)
Organization: MIT EE/CS Computer Facilities, Cambridge, MA
Lines: 21

In article <QWB54=y00Xo9Q3A1c3@andrew.cmu.edu> jk3k+@andrew.cmu.edu (Joe Keane) writes:
>
>In article <1988Mar2.235819.18983@utzoo.uucp>, henry@utzoo.uucp (Henry 
>Spencer) writes:
>> [...].  If they are of the same order of magnitude,
>> then E1+E2 does approximate 2*max(E1, E2) and abandoning one of them does
>> reduce security significantly.
>A factor of two is `significant'?  So if we add one bit to DES (don't ask how) 
>it will be `significantly' more secure?  I disagree.

By your logic, we could remove bits as well, without `significantly'
[sic] reducing security--one-at-a-time, all the way down to one bit,
or even none.

Reasonably secure systems rely on layers of difficult-to-bypass
barriers (e.g. fence, man-eating-dogs, armed guards, locks on building
doors, building alarm system, video cameras, motion detectors, locks
on computer room door(s), etc.) rather than one "impenetrable" maginot
line.

Jeff Siegal