draft paper: Deploying a New Hash Algorithm

2005-07-21 Thread Steven M. Bellovin
Eric Rescorla and I have written a paper Deploying a New Hash Algorithm. A draft is available at http://www.cs.columbia.edu/~smb/papers/new-hash.ps and http://www.cs.columbia.edu/~smb/papers/new-hash.pdf . Here's the abstract: As a result of recent discoveries, the strength of hash

Re: ID theft -- so what?

2005-07-21 Thread Anne Lynn Wheeler
Jeffrey I. Schiller wrote: Btw. There are credit card issuers (ATT Universal is one) that permits you to create a virtual one-time use credit card (with a time limit and $$ limit if you want). So when I shop at a merchant I don't want to trust, I open another browser window and go to my

Qualified Certificate Request

2005-07-21 Thread Philipp Gühring
Hello, Peter Saint-Andre invited me here to present my concept of Qualified Certificate Requests to you. It is a long-term goal of CAcert to be able to provide qualified certificates. Regarding the requirements for qualified certificates, the only obstacle we still have is the problem, that

Re: Qualified Certificate Request

2005-07-21 Thread Anne Lynn Wheeler
Philipp Gühring wrote: Regarding the requirements for qualified certificates, the only obstacle we still have is the problem, that CAcert has to make sure, that the private key for the certificate is generated and stored securely in a SmartCard, or another Hardware Token. Since the users

Re: ID theft -- so what?

2005-07-21 Thread Jerrold Leichter
| an analogy i've used recently with respect to userid/password paradigm, | is that account numbers are being concurrently used for both the userid | function (requiring security *integrity* but not security | *confidentiality*) as well as the password function (requiring strong | security