Re: Client Certificate UI for Chrome?

2009-08-11 Thread Peter Gutmann
"James A. Donald" writes: >This, however, requires both client UI software, and an api to server side >scripts such as PHP, Perl, or Python (the P in LAMP). On the server side, we >need a request object in the script language that tells the script that this >request comes from an entity that est

Entropy USB key

2009-08-11 Thread Alex Pankratov
Just spotted this on one of the tech news aggregators - http://www.entropykey.co.uk The Entropy Key, or eKey, is a small, unobtrusive and easily installed USB stick that generates high-quality random numbers, or entropy, which can improve the performance, security and reliability of

Re: Client Certificate UI for Chrome?

2009-08-11 Thread Frank Siebenlist
[Moderator's note: top posting considered harmful: http://www.mail-archive.com/cryptography@metzdowd.com/msg09287.html --Perry] Just to complicate things a little... we're working with a number of groups now who are using onlineCAs that issue short-lived x509 certs derived from a prim

Re: Client Certificate UI for Chrome?

2009-08-11 Thread James A. Donald
-- > "James A. Donald" writes: >> For password-authenticated key agreement such as >> TLS-SRP or TLS-PSK to work, login has to be in the >> chrome. Peter Gutmann wrote: > Sure, but that's a relatively tractable UI problem Indeed. You know how to solve it, and I know how to solve it, yet th

FW: cleversafe says: 3 Reasons Why Encryption is Overrated

2009-08-11 Thread Jason Resch
Zooko Wilcox-O'Hearn wrote: > > [dropping tahoe-dev from Cc:] > > On Thursday,2009-08-06, at 2:52 , Ben Laurie wrote: > > > Zooko Wilcox-O'Hearn wrote: > >> I don't think there is any basis to the claims that Cleversafe > >> makes that their erasure-coding ("Information Dispersal")-based > >> sys

Re: [tahoe-dev] cleversafe says: 3 Reasons Why Encryption isOverrated

2009-08-11 Thread Zooko Wilcox-O'Hearn
On Monday,2009-08-10, at 13:47 , Zooko Wilcox-O'Hearn wrote: This conversation has bifurcated, Oh, and while I don't mind if people want to talk about this on the tahoe-dev list, it doesn't have that much to do with tahoe-lafs anymore, now that we're done comparing Tahoe-LAFS to Cleversafe

Re: [tahoe-dev] cleversafe says: 3 Reasons Why Encryption isOverrated

2009-08-11 Thread Zooko Wilcox-O'Hearn
This conversation has bifurcated, since I replied and removed tahoe- dev from the Cc: line, sending just to the cryptography list, and David-Sarah Hopwood has replied and removed cryptography, leaving just the tahoe-dev list. Here is the root of the thread on the cryptography mailing list ar

RE: [tahoe-dev] cleversafe says: 3 Reasons Why Encryption isOverrated

2009-08-11 Thread Jason Resch
Zooko Wilcox-O'Hearn wrote: > > [cross-posted to tahoe-...@allmydata.org and cryptogra...@metzdowd.com] > > Folks: > > It doesn't look like I'm going to get time to write a long post about > this bundle of issues, comparing Cleversafe with Tahoe-LAFS (both use > erasure coding and encryption, and

Re: Client Certificate UI for Chrome?

2009-08-11 Thread Peter Gutmann
"James A. Donald" writes: >For password-authenticated key agreement such as TLS-SRP or TLS-PSK to work, >login has to be in the chrome. Sure, but that's a relatively tractable UI problem (and see the comment below on Camino). Certificates on the other hand are an apparently intractable busin

RE: cleversafe says: 3 Reasons Why Encryption is Overrated

2009-08-11 Thread Jason Resch
Zooko Wilcox-O'Hearn wrote: > > [dropping tahoe-dev from Cc:] > > On Thursday,2009-08-06, at 2:52 , Ben Laurie wrote: > > > Zooko Wilcox-O'Hearn wrote: > >> I don't think there is any basis to the claims that Cleversafe > >> makes that their erasure-coding ("Information Dispersal")-based > >> sys

RE: [tahoe-dev] cleversafe says: 3 Reasons Why Encryption isOverrated

2009-08-11 Thread Jason Resch
james hughes wrote: > > On Aug 6, 2009, at 1:52 AM, Ben Laurie wrote: > > > Zooko Wilcox-O'Hearn wrote: > >> I don't think there is any basis to the claims that Cleversafe makes > >> that their erasure-coding ("Information Dispersal")-based system is > >> fundamentally safer, e.g. these claims from

brute force physics Was: cleversafe...

2009-08-11 Thread Alexander Klimov
On Sun, 9 Aug 2009, Jerry Leichter wrote: > Since people do keep bringing up Moore's Law in an attempt to justify > larger keys our systems "stronger than cryptography," it's worth > keeping in mind that we are approaching fairly deep physical limits. > I wrote about this on this list quite a while