Re: Encryption on the AS/400

["Nathan M. Andelin" <nandelin@xxxxxxxxxxxxxxxxxxx>]

From: "Patrick Townsend" <patownsend@patownsend.com>

> Nathan's routine is certainly better than the one I cooked
> up some time ago. But I believe both of us created weak
> cryptography by today's standards.

This doesn't make it easy for me to make a graceful exit from the dialog.
<smile>  No harm done.  Patrick Townsend, Leif Svalgaard, and Don (from DC)
have made some interesting points about encryption off list.  Their points
have been useful to me.  Maybe they would be useful to others.  So I'm
willing to share a little more of my experience as an author of an
encryption algorithm, if it would help others.

I've decided to not offer an encryption solution to others.  I have several
reasons.  I don't know U.S. law well enough.  If my algorithm is weak, it
could be a disservice to somebody.  If my algorithm is strong, and it got
into the wrong hands, then I'd have regrets.   My opinion is that I came up
with a method of producing strong encryption.  However, my method has never
been subject to public scrutiny.

I believe the term "strength" refers to how hard it would be to decipher
encrypted data.  My thinking is that several factors lead to strong
encryption.  The strength of the algorithm.  The use of a key.  The length
of the key.  The secrecy of the algorithm.  The secrecy of the key.  Whether
your adversary has access to the API that produced the encrypted data.
Stuff like that.

To test an encryption algorithm, it helps to have some experience at
breaking encrypted data.  I have some experience.  Nothing malicious.  My
experience may be useful to some people.  While I'm no expert in the
mathematics of encryption I have a good relationship with someone who is.


Nathan M. Andelin
www.relational-data.com