Fwd: [gsc] Digital cache with extended features

2007-05-09 Thread Steve Schear
[Some interesting thinking going on. Wasn't there some similar ideas presented/published at a past FC conference?] Subject: [gsc] Digital cache with extended features Date: Sun, 06 May 2007 12:57:08 +0300 From: George Hara <[EMAIL PROTECTED]> Reply-To: [EMAIL PROTECTED] To: [EMAIL PROTECTED] I

PRZ going in for heart surgery

2007-05-09 Thread Jon Callas
Phil Zimmermann is going in tonight (7 May) for heart bypass surgery. He's not in immediate danger -- he's not having a heart attack, he's not no in immediate danger, but they're pushing him into the hospital quicker than any reasonable person would like. Obviously, that makes for worries.

Forwarded: Public comments on the hash algorithm requirements and evaluation criteria posted online

2007-05-09 Thread Steven M. Bellovin
From: Shu-jen Chang <[EMAIL PROTECTED]> To: [EMAIL PROTECTED] Subject: Public comments on the hash algorithm requirements and evaluation criteria posted online Date: Tue, 08 May 2007 12:13:58 -0400 X-Mailer: QUALCOMM Windows Eudora Version 5.1.1 FYI Public comments on the hash algorithm requireme

Re: Was a mistake made in the design of AACS?

2007-05-09 Thread John Gilmore
> Well, there's an idea: use different physical media formats for > entertainment and non-entertainment content (meaning, content created by > MPAA members vs. not) and don't sell writable media nor devices capable > of writing it for the former, not to the public, keeping very tight > controls on

IEEE International Conference on Intelligence and Security Informatics 2007

2007-05-09 Thread Linda Casals
* IEEE International Conference on Intelligence and Security Informatics 2007 May 23-24, 2007 Hyatt Hotel New Brunswick, New Jersey ** DEADLINE FOR EARLY REGISTRATION IS ALMOST HERE ** Hosted by:

Re: More info in my AES128-CBC question

2007-05-09 Thread Travis H.
On Fri, Apr 27, 2007 at 05:13:44PM -0400, Leichter, Jerry wrote: > Frankly, for SSH this isn't a very plausible attack, since it's not > clear how you could force chosen plaintext into an SSH session between > messages. A later paper suggested that SSL is more vulnerable: > A browser plugin can in

Re: Public key encrypt-then-sign or sign-then-encrypt?

2007-05-09 Thread Travis H.
On Wed, May 02, 2007 at 09:29:39AM -0600, Anne & Lynn Wheeler wrote: > where there is possibly the suggestion that if the only thing being > performed > is authentication (and doesn't require either integrity and/or privacy) ... > then possibly a totally different protocol by utilized (rather than

Enterprise Right Management vs. Traditional Encryption Tools

2007-05-09 Thread Ali, Saqib
I was recently asked why not just deploy a Enterprise Right Management solution instead of using various encryption tools to prevent data leaks. Any thoughts? - The Cryptography Mailing List Unsubscribe by sending "unsubscribe c

Re: More info in my AES128-CBC question

2007-05-09 Thread Thor Lancelot Simon
On Wed, May 09, 2007 at 01:13:36AM -0500, Travis H. wrote: > On Fri, Apr 27, 2007 at 05:13:44PM -0400, Leichter, Jerry wrote: > > Frankly, for SSH this isn't a very plausible attack, since it's not > > clear how you could force chosen plaintext into an SSH session between > > messages. A later pap

Re: Public key encrypt-then-sign or sign-then-encrypt?

2007-05-09 Thread Anne & Lynn Wheeler
Travis H. wrote: This reminds me a bit of a suggestion I once heard for protocol designers that the messages of the various steps of the protocol include a step number or something like it to prevent cut-and-paste attacks (presumably each message has some redundancy to protect the integrity/authe

Re: Enterprise Right Management vs. Traditional Encryption Tools

2007-05-09 Thread Jon Callas
On May 8, 2007, at 10:16 AM, Ali, Saqib wrote: I was recently asked why not just deploy a Enterprise Right Management solution instead of using various encryption tools to prevent data leaks. Any thoughts? What problem are you trying to solve? If you're dealing with a rights-management prob

Re: More info in my AES128-CBC question

2007-05-09 Thread Steven M. Bellovin
On Wed, 9 May 2007 15:35:44 -0400 Thor Lancelot Simon <[EMAIL PROTECTED]> wrote: > On Wed, May 09, 2007 at 01:13:36AM -0500, Travis H. wrote: > > On Fri, Apr 27, 2007 at 05:13:44PM -0400, Leichter, Jerry wrote: > > > Frankly, for SSH this isn't a very plausible attack, since it's > > > not clear h

Re: More info in my AES128-CBC question

2007-05-09 Thread Leichter, Jerry
| > > Frankly, for SSH this isn't a very plausible attack, since it's not | > > clear how you could force chosen plaintext into an SSH session between | > > messages. A later paper suggested that SSL is more vulnerable: | > > A browser plugin can insert data into an SSL protected session, so | > >

Re: More info in my AES128-CBC question

2007-05-09 Thread Leichter, Jerry
| > Frankly, for SSH this isn't a very plausible attack, since it's not | > clear how you could force chosen plaintext into an SSH session between | > messages. A later paper suggested that SSL is more vulnerable: | > A browser plugin can insert data into an SSL protected session, so | > might be

Re: Public key encrypt-then-sign or sign-then-encrypt?

2007-05-09 Thread Travis H.
On Thu, May 03, 2007 at 07:57:18PM +1000, James A. Donald wrote: > Assume Ann's secret key is a, and her public key is A = G^a mod P > > Assume Bob's secret key is b, and his public key is B = G^b mod P > > Bob wants to send Ann a message. > > Bob generates a secret random number x, and sends An