Re: Fixing SSL (was Re: Dutch Transport Card Broken)

2008-02-14 Thread Bill Squier
On Feb 11, 2008, at 8:28 AM, Philipp Gühring wrote: I had the feeling that Microsoft wants to abandon the usage of client certificates completely, and move the people to CardSpace instead. But how do you sign your emails with CardSpace? CardSpace only does the realtime authentication part of

RE: Toshiba shows 2Mbps hardware RNG

2008-02-14 Thread Leichter, Jerry
|SAN FRANCISCO -- Toshiba Corp. has claimed a major breakthrough in |the field of security technology: It has devised the world's |highest-performance physical random-number generator (RNG) |circuit. | |The device generates random numbers at a data rate of 2.0 megabits |a

RE: Open source FDE for Win32

2008-02-14 Thread Dave Korn
On 11 February 2008 04:13, Ali, Saqib wrote: I installed TrueCrypt on my laptop and ran some benchmark tests/ Benchmark Results: http://www.full-disk-encryption.net/wiki/index.php/TrueCrypt#Benchmarks Thanks for doing this! Cons: 1) Buffered Read and Buffered Transfer Rate was almost

Re: Open source FDE for Win32

2008-02-14 Thread Hagai Bar-El
Hello Dave, On 13/2/2008 21:26, Dave Korn wrote: Or are you suggesting that it could encrypt each block OTF when it's first accessed, or run the encryption in the background while the system was still live, instead of converting the whole drive in one big bite? Encrypting blocks only when

Toshiba shows 2Mbps hardware RNG

2008-02-14 Thread David Wagner
Crawford Nathan-HMGT87 writes: One of the problems with the Linux random number generator is that it happens to be quite slow, especially if you need a lot of data. /dev/urandom is blindingly fast. For most applications, that's all you need. (Of course there are many Linux applications that use

Re: Toshiba shows 2Mbps hardware RNG

2008-02-14 Thread alex
- Original Message - From: Pat Farrell [EMAIL PROTECTED] To: Subject: Re: Toshiba shows 2Mbps hardware RNG Date: Sun, 10 Feb 2008 17:40:19 -0500 Perry E. Metzger wrote: [EMAIL PROTECTED] (Peter Gutmann) writes: I've always wondered why RNG speed is such a big deal for

Re: Toshiba shows 2Mbps hardware RNG

2008-02-14 Thread Peter Gutmann
David G. Koontz [EMAIL PROTECTED] writes: Military silicon already has RNG on chip (e.g. AIM, Advanced INFOSEC Machine, Motorola), That's only a part of it. Military silicon has a hardware RNG on chip alongside a range of other things because they know full well that you can't trust only a

House o' Shame: Amtrak

2008-02-14 Thread Perry E. Metzger
Steve Bellovin documents on his blog a recent attempt by Amtrak to teach its customers to be phishing victims: http://www.cs.columbia.edu/~smb/blog/2008-02/2008-02-13.html My comments: Phish someone, and you inconvenience him for a week. Teach a man to be phished, and you screw him for the

Re: Fixing SSL (was Re: Dutch Transport Card Broken)

2008-02-14 Thread RL 'Bob' Morgan
Imagine if a website could instruct your browser to transparently generate a public/private keypair for use with that website only and send the public key to that website. Then, any time that the user returns to that website, the browser would automatically use that private key to

Re: Fixing SSL (was Re: Dutch Transport Card Broken)

2008-02-14 Thread RL 'Bob' Morgan
Is anyone aware of any third-party usability studies on CardSpace, OpenID, ...?). I'm not. It would be a good opportunity for security usability researchers to contribute though. [0] I'm not sure whether putting CardSpace and Liberty in such close proximity in the above line was a