Comments on: Update My Public Key Linux. GNU. Freedom. Thu, 15 Feb 2018 18:04:15 +0000 hourly 1 By: Lamont Peterson Wed, 23 Jan 2008 19:23:32 +0000 @Aaron

I remember Bruce recommending IDEA in the first edition of 'Applied Cryptography,' but not in the second, IIRC. Still I didn't realize he still did quite as late as 1996. I recall reading about weaknesses that had been discovered in IDEA by 1999.

As to the IDEA patent, I thought had been issued much earlier, but perhaps it was just pending in the U.S. until 1993. It looks like the U.S. patent (#5,214,703) will expire in 2010.

Thanks for the information.

I didn't really say it earlier, but patents on cryptographic algorithms are not of much use. Even the <a hre=""NIST will only tolerate patented algorithms in their standardization processes if they are irrevocably licensed for all to use royalty-free. I think that's a great thing. There's so much more detail we could go into on that, but I'll save it for another time.

Of course, you're right about practicality, which is, IMHO one of the reasons to not use IDEA, as it's pretty slow compared to today's crop of block cyphers, such as Blowfish/Twofish and AES.

By: Aaron Wed, 23 Jan 2008 12:23:57 +0000 @Lamont- As far as IDEA is concerned, the patent still holds until 2011, and until 2004, it had shown no weaknesses in cryptanalysis attacks. Bruce Schneier recommended the algorithm in 1996, even. I agree with you that there are definitely better algorithms available, however, due to practicality, it would still take a decent amount of computing power to break the encryption. It may have been reduced to 5 rounds, but that is not feasible on conventional hardware. SHA-1 has also shown to be weakened to 2^69 instead of 2^80 as planned, but breaking SHA-1, or even weakening it, takes far too great computing than the average person would hold. Practicality still rules.

By: Lamont Peterson Wed, 23 Jan 2008 08:13:14 +0000 IIRC, the patent on the IDEA algorithm expired. Since the algorithm was created and patented in the mid 80's and patents only last 17 years and this is 2008, I'm pretty sure about this.

Besides, there were some fatal flaws discovered long before the patent expired, anyway. If your previous employment really did insist on IDEA, then their encrypted communications were (relatively) easy to break. This is a far more important reason to not use IDEA, IMNSHO.

Anyway, if you contact me, I'd be happy to try and help you get your key up on the MIT server. It really is the 'one true keyserver'. 🙂