Re: New Protection for 802.11

2002-11-07 Thread James A. Donald
-- Reading the Wifi report, http://www.weca.net/OpenSection/pdf/Wi- Fi_Protected_Access_Overview.pdf it seems their customers stampeded them and demanded that the security hole be fixed, fixed a damned lot sooner than they intended to fix it. I am struck the contrast between the seemingly

Re: Did you *really* zeroize that key?

2002-11-07 Thread Peter Gutmann
[Moderator's note: FYI: no pragma is needed. This is what C's volatile keyword is for. No it isn't. This was done to death on vuln-dev, see the list archives for the discussion. Peter.

Re: [perry@piermont.com: The FBI Has Bugged Our Public Libraries]

2002-11-07 Thread jayh
While this clarification may be true, the government should realize that the unconstitutional 'deep secret' library searches of the PATRIOT act render such rumors as credible, causing their actions to be treated with deep suspicion even when the actions may be legitimate. [We saw this in the

Re: Amerikan Military: All Your Children Are Belong To Us

2002-11-07 Thread Bill Stewart
At 09:20 AM 11/07/2002 -0800, our local weapon of mass destruction forwarded: Sharon Shea-Keneally, principal of Mount Anthony Union High School in Bennington, Vermont, was shocked when she received a letter in May from military recruiters demanding a list of all her students, including names,

Re: New Protection for 802.11

2002-11-07 Thread Major Variola (ret)
At 05:46 AM 11/7/02 -0800, Sarad AV wrote: hi, Wi fi customers are more paranoid than comparingly ordinary web users who are not so concerened of their security. That's just plain silly. Its like saying a cellphone user is more paranoid than a landline user. It was entirely convenience, with

Re: Did you *really* zeroize that key?

2002-11-07 Thread Steven M. Bellovin
In message [EMAIL PROTECTED], Peter Gutmann writes : [Moderator's note: FYI: no pragma is needed. This is what C's volatile keyword is for. No it isn't. This was done to death on vuln-dev, see the list archives for the discussion. [Moderator's note: I'd be curious to hear a summary -- it

Re: New Protection for 802.11

2002-11-07 Thread Mike Rosing
On Wed, 6 Nov 2002, James A. Donald wrote: -- Reading the Wifi report, http://www.weca.net/OpenSection/pdf/Wi- Fi_Protected_Access_Overview.pdf it seems their customers stampeded them and demanded that the security hole be fixed, fixed a damned lot sooner than they intended to fix it.

RE: New Protection for 802.11

2002-11-07 Thread Trei, Peter
James A. Donald[SMTP:[EMAIL PROTECTED]] wrote: Reading the Wifi report, http://www.weca.net/OpenSection/pdf/Wi- Fi_Protected_Access_Overview.pdf it seems their customers stampeded them and demanded that the security hole be fixed, fixed a damned lot sooner than they intended to fix it.

Re: Did you *really* zeroize that key?

2002-11-07 Thread Dave Howe
Kevin Elliott wrote: The point is though, that according to C99 today volatile int myflag; myflag=0; if (myflag!=0) { do stuff } ; does _exactly_ what you want, per the spec. The only compilers that don't work this way are by definition out of spec, so adding new stuff isn't going to

RE: Did you *really* zeroize that key?

2002-11-07 Thread James A. Donald
-- On 7 Nov 2002 at 16:36, Trei, Peter wrote: The 'volatile' keyword seems to have poorly defined behaviour. Volatile memory typically both receives input from outside the abstract machine, and generates output outside the abstract machine. Indeed the expected reason to write to

Re: Did you *really* zeroize that key?

2002-11-07 Thread Matt Blaze
At 03:55 PM 11/7/02 +0100, Steven M. Bellovin wrote: Regardless of whether one uses volatile or a pragma, the basic point remains: cryptographic application writers have to be aware of what a clever compiler can do, so that they know to take countermeasures. Wouldn't a crypto coder be

Re: Did you *really* zeroize that key?

2002-11-07 Thread David Honig
At 03:55 PM 11/7/02 +0100, Steven M. Bellovin wrote: Regardless of whether one uses volatile or a pragma, the basic point remains: cryptographic application writers have to be aware of what a clever compiler can do, so that they know to take countermeasures. Wouldn't a crypto coder be using

Re: Did you *really* zeroize that key?

2002-11-07 Thread Patrick Chkoreff
From: Trei, Peter [EMAIL PROTECTED] [Moderator's note: FYI: no pragma is needed. This is what C's volatile keyword is for. Unfortunately, not everyone writing in C knows the language. --Perry] Thanks for the reminder about volatile. It is an ancient and valuable feature of C and I suppose

Re: Did you *really* zeroize that key?

2002-11-07 Thread Patrick Chkoreff
From: Trei, Peter [EMAIL PROTECTED] [Moderator's note: FYI: no pragma is needed. This is what C's volatile keyword is for. Unfortunately, not everyone writing in C knows the language. --Perry] Thanks for the reminder about volatile. It is an ancient and valuable feature of C and I suppose

Re: patent free(?) anonymous credential system pre-print - asimpleattack and other problems

2002-11-07 Thread Stefan Brands
Hello Jason: Page 193 and 210 do talk about having an identifying value encoded in the credentials which the holder can prove is or isn't the same as in other credentials. However, the discussion on page 193 is with respect to building digital pseudonyms No, not at all. The paragraph on page