Details of the backdoor-padlock

2007-02-27 Thread Hadmut Danisch
the left side of the rightmost wheel. It is visible, but must point down to open. Turn the wheels until you see this, and then turn them another 180 degrees, and: "Open Sesame!" So no need to bother with a TSA key. Open

Re: padlocks with backdoors - TSA approved

2007-02-27 Thread Hadmut Danisch
it. The tank cap had a lock inside. All you needed to do is to cut the plastic lock open and to copy the tumbler lengths to a blank key. Then you have a working key. You could do the same and just open some of these locks, one per key number.

Re: padlocks with backdoors - TSA approved

2007-02-27 Thread Hadmut Danisch
so "seal" the case with any unusual sticker I got somewhere for free or a paper sticker. The method with the cable binder became difficult since it is forbidden to have a nail scissors in the bord luggage. Sometimes not that easy to open it without dam

Re: padlocks with backdoors - TSA approved

2007-02-27 Thread Hadmut Danisch
Hi Allen, On Mon, Feb 26, 2007 at 09:23:30PM -0800, Allen wrote: > Hi Hadmut, > > combination lock brands in the $30 to $45 USD range where you can > set the combination to whatever you want. Guess what? They all > seemed to use the same key to enable setting the combination.

Re: padlocks with backdoors - TSA approved

2007-02-27 Thread Hadmut Danisch
p?_room=3&_action=detail&id=72 That's another one: http://www.eaglecreek.com/accessories/security_id/TSA-SearchAlert-Lock-41027/ The TSA keyhole is always on the other side such that you don't see them. I am currently in a hurry, but I'll mak

padlocks with backdoors - TSA approved

2007-02-26 Thread Hadmut Danisch
intact and in place instead of cut off. This is the point where I decided to have nightmares from now on. regards Hadmut - The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]

Re: RSA SecurID SID800 Token vulnerable by design

2006-09-09 Thread Hadmut Danisch
did not work. They had to be told not to type in the serial number engraved at the backside, but the number displayed on the LCD...). It's a pity to see it weakened without need to. regard Hadmut - The Cryptography Mail

Re: RSA SecurID SID800 Token vulnerable by design

2006-09-09 Thread Hadmut Danisch
login. But when you could use the current token code as an indicator for searching login data in the input stream, then you can find new places to login, e.g. your company VPN access point. While the attack you describe is more important for banking, the

RSA SecurID SID800 Token vulnerable by design

2006-09-08 Thread Hadmut Danisch
the PIN and the address of the server to login is contained. Makes it really easy to automatically detect secrets in the input stream. Thus, two different authentication methods are together weaker than each single one. regards Hadmut --

Re: PGP "master keys"

2006-04-28 Thread Hadmut Danisch
Once you managed to have your pubkey added to someone else's keyring with an additional empty user ID (what most users never realize) you could read any encrypted mail sent by that person. regards Hadmut - The Cryptography Mai

Re: History and definition of the term 'principal'?

2006-04-26 Thread Hadmut Danisch
Page 129: "A principal is anything or anyone participating in cryptographically protected communication." - Page 266: "each user and each resource that will be using Kerberos." Which edition is yours? regards Hadmut

History and definition of the term 'principal'?

2006-04-26 Thread Hadmut Danisch
h speaker. Can anyone give me some hints? Maybe about how 'principal' is related to Roger Needham? Or whether there is a precise and general definition? Who, btw, would have the authority to generally define terms in security science? regards Hadmut --

How security could benefit from high volume spam

2005-12-14 Thread Hadmut Danisch
" When designing measures against spam, we should take this into consideration. Maybe in near future the advantages of that noise produced by millions of bots will outweigh the disadvantages? Comments are welcome. Hadmut Danisch

Re: HTTPS mutual authentication alpha release - please test

2005-11-07 Thread Hadmut Danisch
s WIKID's certificate verification procedure more reliable than the one of the "trusted CAs" ? Hadmut - The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]

Re: solving the wrong problem

2005-08-06 Thread Hadmut Danisch
. regards Hadmut - The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]

Re: [Forwarded] RealID: How to become an unperson.

2005-07-06 Thread hadmut
ID cards officially. Last November I attended an Anti-Spam-Summit at FTC in Washington DC. As usual they were checking for metal in the clothes, x-raying bags, and (*surprise*) asking for a picture ID. Someone didn't have a driving license. They accepted his WalMar

Re: [Forwarded] RealID: How to become an unperson.

2005-07-05 Thread hadmut
sually applying for an ID card is not a problem at all. For reasons far beyond cryptography my father chose an unusual given name for me, one that was usual in around the 8th-10th century. He named me Hadmut. Most people in Germany have never heard that name before and don't believe, that this n

Papers about "Algorithm hiding" ?

2005-05-30 Thread Hadmut Danisch
ne can not prove to be an encryption algorithm? regards Hadmut - The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]

Re: Cryptanalytic attack on an RFID chip

2005-01-30 Thread Hadmut Danisch
remote control to open the doors by pressing a button at the key. Does this attack compromise the theft protection only or the door opener as well? regards Hadmut - The Cryptography Mailing List Unsubscribe by sending "

Re: Where to get a Jefferson Wheel ?

2005-01-05 Thread Hadmut Danisch
tended to choose any row, but to use the row directly under the plaintext row as cipher text. Instead of the line indicator from Jefferson, they have a sliding bar with two windows for two subsequent rows. regards Hadmut - The C

Re: Where to get a Jefferson Wheel ?

2005-01-05 Thread Hadmut Danisch
Dean, James wrote: The order of the wheels can't be changed. So this encryption device doesn't use any key? regards Hadmut - The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]

Where to get a Jefferson Wheel ?

2005-01-04 Thread Hadmut Danisch
Hi, does anyone know where I can get a Jefferson Wheel or a replica? regards Hadmut - The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]

Re: M-209 broken in WWII

2004-09-29 Thread Hadmut Danisch
should ask the publisher for a translation, because under german copyright law even the translation is a right of the author. regards Hadmut - The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]

Re: [anonsec] Re: potential new IETF WG on anonymous IPSec (fwd from [EMAIL PROTECTED]) (fwd from [EMAIL PROTECTED])

2004-09-18 Thread Hadmut Danisch
do believe that this requires some discussion. I'd propose a separate mailing list for that. regards Hadmut - The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]

Re: public-key: the wrong model for email?

2004-09-16 Thread Hadmut Danisch
is where reality and the science of cryptography differ. It does not work because not all attackers agree to play the Alice&Bob game. regards Hadmut - The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]

Forensic: Who gave this crypto talk?

2004-09-15 Thread Hadmut Danisch
immons is mentioned several times, but this might not have been part of the talk but a personal annotation of the person who made the transcript. Does anyone know about such a talk? (The notes are available at http://www

Re: potential new IETF WG on anonymous IPSec

2004-09-14 Thread Hadmut Danisch
nication. But avoiding faked TCP resets is also a matter of authenticity. Does 'opportunistic authentication' exist? regards Hadmut - The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]

Re: Spam Spotlight on Reputation

2004-09-07 Thread Hadmut Danisch
hijacked and raped by patent claims. regards Hadmut - The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]

Re: Compression theory reference?

2004-09-01 Thread Hadmut Danisch
). Thanks, that's a pretty good hint, especially because it contains an explicit statement, and it's an FAQ, making it easy to show, that the university's claim is not just wrong, but silly. :-) regards Hadmut - T

Re: Compression theory reference?

2004-09-01 Thread Hadmut Danisch
ssion rate for a file people often forget, that some information is not stored in the file itself, but in the file system, e.g. the file length (telling where the compressed data stops) and the file name (telling you, that the file was compressed). That's basical

Re: Compression theory reference?

2004-09-01 Thread Hadmut Danisch
m to take any random string taken from /dev/random under Linux. They don't care. The german principle is that a faculty is always right by definition. > 3) Diagram the pigeon-hole argument for the judge. See > diagrams below. I'll try that. Thanks. regards Hadmut - The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]

Compression theory reference?

2004-08-31 Thread Hadmut Danisch
ing theory which explicitely states the impossibility of such a compression method in plain language? regards Hadmut - The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]

cryptograph(y|er) jokes?

2004-06-22 Thread Hadmut Danisch
Hi, does anyone know good jokes about cryptography, cryptographers, or security? regards Hadmut [Moderator's note: I know of several security systems that are jokes in and of themselves, but that doesn't seem to be what you meant.

Re: The future of security

2004-05-08 Thread Hadmut Danisch
a summary, I don't expect any innovations. Not more than within the last 10 years. But I'm pretty sure that security will be more and more important and that's were I expect innovations and progress. Security doesn't necessarily mean cryptography. regards Hadmut

Definitions of "Security"?

2004-04-14 Thread hadmut
finitions (or attempts to give those), and I'd be interested to compare them. If you know of any definition that might be interesting for any reason, please send me a link or citation. thanx regards Hadmut - The Cryptography

Re: Do Cryptographers burn?

2004-04-04 Thread Hadmut Danisch
rtises. Some people even explicetely confirmed that my dissertation is correct and the expertises are wrong. This just doesn't matter in any way. Isn't that spooky? What kind of business is cryptography? regards Hadmut - The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]

Do Cryptographers burn?

2004-04-03 Thread Hadmut Danisch
d security just to do a colleague a favor, when he erroneously assumed the expertise would be kept secret? Would such a cryptographer be considered as burned? Wouldn't he give more false expertises once he's getting paid for or asked by his government? I'd be interested in

Canon's Image Data Verification Kit DVK-E2 ?

2004-03-31 Thread Hadmut Danisch
x27;t find any details, just marketing blabla. regards Hadmut - The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]

OOAPI-SSL/TLS (Was: Simple SSL/TLS - Some Questions)

2003-10-04 Thread Hadmut Danisch
ith the way Michal Rokos wrapped openssl into an object oriented API, but it would be good to have this in more languages, it still allows improvements and is still incomplete. regards Hadmut - The Cryptography Ma

Re: quantum hype

2003-09-16 Thread Hadmut Danisch
an identity of the receiver. Even if it is true that just a single receiver can read the information, it is still unknown, _who_ it is. All you know is that you send information which can be read by a single receiver only. And you hope that this receiver was the goo

Re: invoicing with PKI

2003-09-02 Thread Hadmut Danisch
ut cryptography, but not without a firewall and content filters. But many people still insist on the claim that cryptography is by far the most important and only scientific form of network security. Is cryptography where security took the wrong branch? regards Hadmut

Re: invoicing with PKI

2003-08-26 Thread Hadmut Danisch
re there anyway? (except for the standard tools SSL, X.509,...) Is there a survey of where in e-business cryptography is actually being used between customers and providers? How many shops do use SET for payment? regards Hadmut --