Re: Toshiba shows 2Mbps hardware RNG

2008-02-13 Thread Pat Farrell
Perry E. Metzger wrote: [EMAIL PROTECTED] (Peter Gutmann) writes: I've always wondered why RNG speed is such a big deal for anything but a few highly specialised applications. Perhaps it isn't, but any hardware RNG is probably better than none for many apps, and they've managed to put the

Re: Toshiba shows 2Mbps hardware RNG

2008-02-13 Thread David G. Koontz
Hal Finney wrote: Looking at the block diagram for the new Toshiba circuit, and comparing with the Intel design, one concern I have is with attacks on the device via external electromagnetic fields which could modulate current flows and potentially influence internal random numbers. Intel

Re: Open source FDE for Win32

2008-02-13 Thread Ali, Saqib
I installed TrueCrypt on my laptop and ran some benchmark tests/ Benchmark Results: http://www.full-disk-encryption.net/wiki/index.php/TrueCrypt#Benchmarks Pros: 1) Easy to use product. Simple clean interface. Very user-friendly! 2) Free and Open Source 3) Multiple Encryption and Hashing

Dilbert on security

2008-02-13 Thread Leichter, Jerry
Today's Dilbert - http://www.unitedmedia.com/comics/dilbert/archive/images/dilbert23667240080211.gif is right on point -- Jerry - The Cryptography Mailing List

Re: Gutmann Soundwave Therapy

2008-02-13 Thread Peter Gutmann
Daniel Carosone [EMAIL PROTECTED] writes: On Mon, Feb 04, 2008 at 02:48:08PM -0700, Martin James Cochran wrote: Additionally, in order to conserve bandwidth you might want to make a trade-off where some packets may be forged with small probability (in the VOIP case, that means an attacker gets

Re: TLS-SRP TLS-PSK support in browsers (Re: Dutch Transport Card Broken)

2008-02-13 Thread James Cloos
Werner == Werner Koch [EMAIL PROTECTED] writes: Werner The last time I checked the Mozilla code they used their own crypto Werner stuff. When did they switched to OpenSSL and how do they solve the Werner GPL/OpenSSL license incompatibility? Indeed they do. It is called nss, is available as a

Re: Open source FDE for Win32

2008-02-13 Thread Hagai Bar-El
Hello, On 11/2/2008 06:13, Ali, Saqib wrote: I installed TrueCrypt on my laptop and ran some benchmark tests/ Benchmark Results: http://www.full-disk-encryption.net/wiki/index.php/TrueCrypt#Benchmarks Pros: 1) Easy to use product. Simple clean interface. Very user-friendly! 2) Free and Open

Re: questions on RFC2631 and DH key agreement

2008-02-13 Thread Joseph Ashwood
- Original Message - From: Hal Finney [EMAIL PROTECTED] To: [EMAIL PROTECTED]; cryptography@metzdowd.com Sent: Sunday, February 10, 2008 9:27 AM Subject: Re: questions on RFC2631 and DH key agreement Joseph Ashwood writes: From: Hal Finney [EMAIL PROTECTED] Joseph Ashwood writes,

Re: Fixing SSL (was Re: Dutch Transport Card Broken)

2008-02-13 Thread Philipp G├╝hring
Hi, Microsoft broke this in IE7... It is no longer possible to generate and enroll a client cert from a CA not on the trusted root list. So private label CAs can no longer enroll client certs. We have requested a fix, so this may come in the future, but the damage is already done... Also

Re: Gutmann Soundwave Therapy

2008-02-13 Thread Daniel Carosone
On Mon, Feb 11, 2008 at 07:01:07PM +1300, Peter Gutmann wrote: Daniel Carosone [EMAIL PROTECTED] writes: [...] Particularly for the first point, early validation for packet integrity in general can be a useful defensive tool against unknown potential implementation vulnerabilities. This is

Re: Toshiba shows 2Mbps hardware RNG

2008-02-13 Thread Peter Gutmann
[EMAIL PROTECTED] (Hal Finney) writes: When the Intel RNG came out several years ago, built into the bus controller chipset, it was not widely accepted by the cryptographic community due to fears of back doors or internal weaknesses. A generally positive analysis by Cryptographic Research

Re: Toshiba shows 2Mbps hardware RNG

2008-02-13 Thread Peter Gutmann
Danilo Gligoroski [EMAIL PROTECTED] writes: At 04:02 AM 2/10/2008, Peter Gutmann wrote: Perry E. Metzger [EMAIL PROTECTED] writes: \snip So your potential market for this is people running Monte Carlo simulations who don't like PRNGs. Seems a bit of a limited market... I think that the market