Did you *really* zeroize that key?

2002-11-06 Thread Trei, Peter
[Moderator's note: FYI: no pragma is needed. This is what C's volatile keyword is for. Unfortunately, not everyone writing in C knows the language. --Perry] From RISKS: http://catless.ncl.ac.uk/Risks/22.35.html#subj6 Those of us who write code need to be reminded of this now and then. Peter

Re: Did you *really* zeroize that key?

2002-11-06 Thread Perry E. Metzger
Someone wrote to me: According to KR 2nd Ed. p. 211, compilers may ignore volatile; volatile objects have no implementation- independent semantics. KR is not the C standard. Quoting the C99 standard, section 6.7.3.6: An object that has volatile-qualified type may be modified in

Re: patent free(?) anonymous credential system pre-print

2002-11-06 Thread Marc Branchaud
bear wrote: It's not terribly helpful for someone to lock up an idea for twenty years, but honestly it may be at least that long before the legal and cultural infrastructure is ready to fully take advantage of it anyway. Absolutely. Which is precisely why we need an extension to patent

German authorities bungle wiretaps.

2002-11-06 Thread Perry E. Metzger
German police have been forced to admit that dozens of criminal suspects had learned their phones were being tapped when the evidence showed up on their monthly phone bill. [...] Telecommunications authorities said that nearly 20,000 lines were currently being tapped.

New Protection for 802.11

2002-11-06 Thread Perry E. Metzger
From Dave Farber's Interesting People list. Does anyone know details of the new proposed protocols? ---BeginMessage--- From: Dewayne Hendricks [EMAIL PROTECTED] Subject: [Dewayne-Net] New Protection for 802.11 To: Dewayne-Net Technology List [EMAIL PROTECTED] Date: Tue, 05 Nov 2002 13:17:54

Re: New Protection for 802.11

2002-11-06 Thread David Honig
At 03:32 PM 11/6/02 -0500, Perry E. Metzger wrote: Does anyone know details of the new proposed protocols? Small article at: http://www.eetimes.com/story/OEG20021031S0007 Somewhere I read a larger article; things that stuck in memory are: No AES, a cipher called Michael being used; also, the

Re: New Protection for 802.11

2002-11-06 Thread William Arbaugh
It uses: -IEEE 802.1x for access control and authentication -RC4 but with a new key mixing/generation method called TKIP that provides for per packet keys and eliminates the Fluhrer et. al. attack. Russ Housely, Doug Whitting, and Nils Ferguson designed TKIP. -Michael is the MAC/MIC that

Re: Did you *really* zeroize that key?

2002-11-06 Thread Marc Branchaud
If I use volatile char *foo; is the pointer volatile or is the memory it points to volatile? What does the standard say? Obviously, I want to memory to be treated as volatile... M. - The

RE: German authorities bungle wiretaps.

2002-11-06 Thread Peter Kuhm
At 12:57 06.11.02 -0800, Jay D. Dyson wrote: On Wed, 6 Nov 2002, Steven Soroka wrote: Which prompts the question, what the hell for? Sounds like an incredible abuse of power. Do you think they have 20,000 warrants to back that up? If so, why is Germany so full of criminals? hehehe.

Re: German authorities bungle wiretaps.

2002-11-06 Thread Hadmut Danisch
On Wed, Nov 06, 2002 at 02:24:18PM -0600, Steven Soroka wrote: Which prompts the question, what the hell for? That's a pretty good question. Police and Secret Services demanded wiretapping access as absolutely necessary for catching criminals etc. Some politicians agreed for some short time,

Re: New Protection for 802.11

2002-11-06 Thread Arnold G. Reinhold
See the following two Intel links with detailed discussions of TKIP and Michael which i found via Google: Increasing Wireless Security with TKIP Forwarded from: eric wolbrom, CISSP, sa ISN-a... http://www.secadministrator.com/Articles/Index.cfm?ArticleID=27064 Mark Joseph Edwards October 23,

Re: Did you *really* zeroize that key?

2002-11-06 Thread Peter Gutmann
[Moderator's note: FYI: no pragma is needed. This is what C's volatile keyword is for. No it isn't. This was done to death on vuln-dev, see the list archives for the discussion. [Moderator's note: I'd be curious to hear a summary -- it appears to work fine on the compilers I've tested.