Re: Type of encryption is used by Skype.

Kevin McCoy wrote:
> One of  SFs encryption algorithms is Blowfish - a variable length, *448 bit*
> encryption algorithm. By my calculation, Blowfish supports 6.2 x 10 to the
> 57th power more possible keys than does AES.  I am a bit suspicious of
> government sponsored encryption standards.

Actually, while Blowfish supports keys up to 448 bits in
length, the version used in Speak Freely only uses keys of
128 bits.  Speak Freely's implementation of AES permits
keys of either 128 or 256 bits, and hence, in 256 bit mode,
is more secure than Blowfish *as used by Speak Freely*.

I see no reason to be suspicious of AES because it has been
adopted as a U.S. government standard.  The algorithm, Rijndael, was
one of several which competed to become the standard and is
completely disclosed.  I know of no professional cryptographer
who believes it to be inferior to any of the alternatives.  Rijndael
existed before it was adopted to become AES and survived peer review.
Actually, DES, IDEA, Blowfish, and Rijndael/AES are similar
block ciphers which differ in key lengths and refinements such
as vulnerabilities to weak keys.  For details of AES, a good
place to start is:

     http://csrc.nist.gov/CryptoToolkit/aes/rijndael/

Not to be paranoid, but one of the advantages of an open source
program is that you can *personally confirm* that the encryption
code it's using (whatever the algorithm) is identical to that
of the algorithm it claims to use, and that nobody's introduced
a backdoor.  In a closed source program, particularly one which
involves a server, it would be very easy, for example, to send
a copy of the encryption key to a server which could be used
to decrypt conversations.  How do you know Speak Freely doesn't
do this?  Look at the source code!  How do you know some other
program whose source code isn't published doesn't do that?
...

--------  <http://www.fourmilab.ch/>  -----------------------
John Walker           | Trust thy vendor:  "This may take a
[email protected]   |   minute.  If you are asked for the root
                       |   password, enter it and click OK."
                       | -- Silicon Graphics Web download page


                      * * *

To unsubscribe from this mailing list, send E-mail containing
the word "unsubscribe" in the message body (*not* as the
Subject) to [email protected]