RE: link fest on fingerprint biometrics

2006-09-09 Thread Dave Korn
On 08 September 2006 00:38, Travis H. wrote: > At home I have an excellent page on making fake fingerprints, but I > cannot find it > right now. It used gelatin (like jello) and was successful at fooling a > sensor. http://search.theregister.co.uk/?q=gummi should be a start. cheers,

Re: link fest on fingerprint biometrics

2006-09-09 Thread Jens Kubieziel
* Travis H. schrieb am 2006-09-08 um 01:37 Uhr: > If anyone can give me any fingerprint-related links, particularly > about spoofing/breaking them, I would be grateful. http://www.ccc.de/biometrie/fingerabdruck_kopieren?language=en -- Jens Kubieziel http://www.k

Exponent 3 damage spreads...

2006-09-09 Thread Ben Laurie
This is a multi-part message in MIME formatthought this might interest people here. -- http://www.apache-ssl.org/ben.html http://www.links.org/ "There is no limit to what a man can do or how far he can go if he doesn't mind who gets the credit." - Robert Woodruff --- Begin Message 

Re: signing all outbound email

2006-09-09 Thread Paul Hoffman
At 7:02 AM +1000 9/8/06, James A. Donald wrote: I do not seem to be able to use DKIM to for spam filtering. Correct. It is for white-listing. It tells the recipient (MTA or MUA) that the message received was sent from the domain name it says it was, and that parts of the message were not alte

Re: RSA SecurID SID800 Token vulnerable by design

2006-09-09 Thread Lance James
Hadmut Danisch wrote: > Hi, > > I recently tested an RSA SecurID SID800 Token > http://www.rsasecurity.com/products/securid/datasheets/SID800_DS_0205.pdf > > > The token is bundled with some windows software designed to make > user's life easier. Interestingly, this software provides a function

Re: RSA SecurID SID800 Token vulnerable by design

2006-09-09 Thread Hadmut Danisch
Hi Lance, On Fri, Sep 08, 2006 at 10:26:45AM -0700, Lance James wrote: > > Another problem from what I see with Malware that steals data is the > formgrabbing and "on event" logging of data. Malware can detect if > SecureID is being used based on targeted events, example: Say HSBC > (Hypothetical

Re: RSA SecurID SID800 Token vulnerable by design

2006-09-09 Thread Lance James
Hadmut Danisch wrote: > Hi Lance, > > On Fri, Sep 08, 2006 at 10:26:45AM -0700, Lance James wrote: >> Another problem from what I see with Malware that steals data is the >> formgrabbing and "on event" logging of data. Malware can detect if >> SecureID is being used based on targeted events, examp

Re: Raw RSA

2006-09-09 Thread James Muir
Hal Finney wrote: Alexander Klimov asks: If an attacker is given access to a raw RSA decryption oracle (the oracle calculates c^d mod n for any c) is it possible to extract the key (d)? This is equivalent to asking whether factoring reduces to RSA inversion. That is, given access to an RSA inv

Re: RSA SecurID SID800 Token vulnerable by design

2006-09-09 Thread Hadmut Danisch
On Fri, Sep 08, 2006 at 11:31:28AM -0700, Lance James wrote: > SecurID should not be the only concept for dependence. Yeah, however, it is a smart device which provides a reasonable level of security in a very simple and almost foolproof way (I know a case where the users complained that it did

RE: Locating private keys in RAM?

2006-09-09 Thread Andrew Tucker
The link to the paper is broken but this one works: http://www.cs.jhu.edu/~astubble/600.412/s-c-papers/keys2.pdf#search=%22k eyhide2.pdf%22 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Thomas Sent: Wednesday, September 06, 2006 1:21 AM To: Douglas F. C

Any opinions on Kryptor...?

2006-09-09 Thread David Wagner
Leandro Meiners writes: >Has anybody heard about Kryptor? Any opinions? >(Link: http://www.rosiello.org/modules/smartsection/visit.php?fileid=1) I have no clue whether the stream cipher in that paper is any good, but the security analysis in the paper is basically nonsense. The paper contains gib

Re: link fest on fingerprint biometrics

2006-09-09 Thread Krister Walfridsson
On Thu, 7 Sep 2006, Travis H. wrote: At home I have an excellent page on making fake fingerprints, but I cannot find it right now. It used gelatin (like jello) and was successful at fooling a sensor. I did find this, which reports success with gummi bears: http://msn.pcworld.com/article/id,

Re: RSA SecurID SID800 Token vulnerable by design

2006-09-09 Thread Sean W. Smith
One can have a lot of fun with key-wielding tokens, especially on Windows. See: J. Marchesini, S.W. Smith, M. Zhao. "Keyjacking: the Surprising Insecurity of Client-side SSL." Computers and Security. 4 (2): 109-123. March 2005. http://www.cs.dartmouth.edu/~sws/pubs/msz05.pdf --Sean Sean

IGE mode is broken (Re: IGE mode in OpenSSL)

2006-09-09 Thread Adam Back
Hi Ben, Travis IGE if this description summarized by Travis is correct, appears to be a re-invention of Anton Stiglic and my proposed FREE-MAC mode. However the FREE-MAC mode (below described as IGE) was broken back in Mar 2000 or maybe earlier by Gligor, Donescu and Iorga. I recommend you do not