Bill Frantz wrote:
At 6:16 PM -0800 4/2/03, Seth David Schoen wrote:
Bill Frantz writes:
The http://cryptome.org/usage-logs.htm URL says:
Low resolution data in most cases is intended to be sufficient for
marketing analyses. It may take the form of IP addresses that have been
subjected to a
John Young wrote:
Ben,
Would you care to comment for publication on web logging
described in these two files:
http://cryptome.org/no-logs.htm
http://cryptome.org/usage-logs.htm
Cryptome invites comments from others who know the capabilities
of servers to log or not, and other means for
Eric Rescorla wrote:
John Gilmore [EMAIL PROTECTED] writes:
Remember, the cypherpunks ... secured any Web traffic
Credit where it's due. Netscape was responsible for this.
Only for the client side (and the protocol, of course).
Cheers,
Ben.
--
http://www.apache-ssl.org/ben.html
Ed Gerck wrote:
BTW, this is NOT the way to make paying for CA certs go
away. A technically correct way to do away with CA certs
and yet avoid MITM has been demonstrated to *exist*
(not by construction) in 1997, in what was called intrinsic
certification -- please see www.mcg.org.br/cie.htm
Phew,
Ed Gerck wrote:
Ben Laurie wrote:
Ed Gerck wrote:
;-) If anyone comes across a way to explain it, that does not require study,
please let me know and I'll post it.
AFAICS, what it suggests, in a very roundabout way, is that you may be
able to verify the binding between a key and some kind of DN
I have updated the Lucre paper with a new section on choosing
parameters, in response to question from the lucrative project.
It can be found in the usual place: http://anoncvs.aldigital.co.uk/lucre/.
If I find (or write) free software that does primality proofs, then I
guess I'll update it
Tero Kivinen wrote:
Ben Laurie writes:
Jack Lloyd wrote:
Check RFC 2412, draft-ietf-ipsec-ikev2-05.txt, and
draft-ietf-ipsec-ike-modp-groups-05.txt
However, I don't seen any primality proof certificates included in the
texts.
I considered adding the ecpp certificates to
draft-ietf-ipsec-ike
Jack Lloyd wrote:
I believe the IPSec primes had been proven. All are SG primes with a g=2
Check RFC 2412, draft-ietf-ipsec-ikev2-05.txt, and
draft-ietf-ipsec-ike-modp-groups-05.txt
However, I don't seen any primality proof certificates included in the
texts.
RFC 2412 looks good, however, as you
I'm looking for a list or lists of sensibly sized proven primes - all
the lists I can find are more interested in records, which are _way_ too
big for cryptographic purposes.
By sensibly sized I mean in the range 512-8192 bits. I'm particularly
after Sophie Germain primes right now, but I
Douglas Lee Schales wrote:
In reply to your message dated: Wed, 22 Jan 2003 13:09:30 EST
This is has descended into the ridiculous. TCPA has been tossed about
as being a great coming evil, the end of the open computing world. We
finally get some technical information published about TCPA
Matt Blaze wrote:
Patents were originally intended, and are usually used (for better
or for worse), as a mechanism for protecting inventors and their
licensees from competition. But I've noticed a couple of areas where
patents are also used as a security mechanism, aiming to prevent the
William Knowles wrote:
Prime numbers (such as 1, 5, 11, 37...) are divisible only by
themselves or 1. While smaller prime numbers are easy to make out, for
very large numbers, there never had been a formula for primality
testing until August 2002.
Doh! This is so untrue. The point is that
Matthew Byng-Maddick wrote:
On Wed, Oct 02, 2002 at 10:04:03AM -0500, Jeremey Barrett wrote:
BTW, most and probably all of the major mail clients out there will do
STARTTLS *for SMTP*. It's a matter of servers offering it and clients
being configured to actually use it. It'd be nice if they
Peter Gutmann wrote:
I recently came across a real-world use of steganography which hides extra
data in the LSB of CD audio tracks to allow (according to the vendor) the
equivalent of 20-bit samples instead of 16-bit and assorted other features.
According to the vendors, HDCD has been used in
Markus Friedl wrote:
On Mon, Sep 23, 2002 at 02:50:20PM +0100, Ben Laurie wrote:
(1) they promise not to sue Sun for infringing any of their own patents
which might
cover the use of the donated code
(2) don't modify Sun's code as provided by Sun, don't use only parts of
the donated code
David Wagner wrote:
What is it, then?
The ultimate pokemon card!
Cheers,
Ben.
--
http://www.apache-ssl.org/ben.html http://www.thebunker.net/
There is no limit to what a man can do or how far he can go if he
doesn't mind who gets the credit. - Robert Woodruff
Nomen Nescio wrote:
Some of the claims seem a little broad, like this first one:
1. A method for establishing a pseudonym system by having a certificate
authority accepting a user as a new participant in said pseudonym system,
the method comprising the steps of: receiving a first public key
Nomen Nescio wrote:
It looks like Camenisch Lysyanskaya are patenting their credential
system. This is from the online patent applications database:
bear wrote:
On Thu, 29 Aug 2002, Frank Andrew Stevenson wrote:
What is there to prevent that one single undisclosed buffer overrun bug in
a component such as Internet Explorer won't shoot down the whole DRM
scheme of Palladium ? Presumably IE will be able to run while the machine
is in a
Paul Crowley wrote:
I'm informed that malware authors often go to some lengths to prevent
their software from being disassembled. Could they use Palladium for
this end? Are there any ways in which the facilities that Palladium
and TCPA provide could be useful to a malware author who wants
Joseph Ashwood wrote:
- Original Message -
From: Ben Laurie [EMAIL PROTECTED]
Joseph Ashwood wrote:
There is nothing stopping a virtualized version being created.
What prevents this from being useful is the lack of an appropriate
certificate for the private key in the TPM
Joseph Ashwood wrote:
Lately on both of these lists there has been quite some discussion about
TCPA and Palladium, the good, the bad, the ugly, and the anonymous. :)
However there is something that is very much worth noting, at least about
TCPA.
There is nothing stopping a virtualized
AARG!Anonymous wrote:
Adam Back writes:
- Palladium is a proposed OS feature-set based on the TCPA hardware
(Microsoft)
Actually there seem to be some hardware differences between TCPA and
Palladium. TCPA relies on a TPM, while Palladium uses some kind of
new CPU mode. Palladium
Lucky Green wrote:
Ray wrote:
From: James A. Donald [EMAIL PROTECTED]
Date: Tue, 30 Jul 2002 20:51:24 -0700
On 29 Jul 2002 at 15:35, AARG! Anonymous wrote:
both Palladium and TCPA deny that they are designed to restrict
what applications you run. The TPM FAQ at
David Wagner wrote:
Amir Herzberg wrote:
So I ask: is there a definition of this `no wasted entropy` property, which
hash functions can be assumed to have (and tested for), and which ensures
the desired extraction of randomness?
None that I know of. I'm not aware of much work in the
John Saylor wrote:
Hi
I'm passing some data through a web client [applet-like] and am planning
on using some crypto to help ensure the data's integrity when the applet
sends it back to me after it has been processed.
The applet has the ability to encode data with several well known
David Wagner wrote:
Bill Frantz wrote:
If there is a digital signature algorithm which has the property that most
invalid signatures can be detected with a small amount of processing, then
I can force the attacker to start expending his CPU to present signatures
which will cause my server to
--
http://www.apache-ssl.org/ben.html http://www.thebunker.net/
There is no limit to what a man can do or how far he can go if he
doesn't mind who gets the credit. - Robert Woodruff
---BeginMessage---
http://www.theregister.co.uk/content/55/25444.html
Palm Beach International
--
http://www.apache-ssl.org/ben.html http://www.thebunker.net/
There is no limit to what a man can do or how far he can go if he
doesn't mind who gets the credit. - Robert Woodruff
---BeginMessage---
This gem of crypto-related news seems to have slipped by unobserved...
UK leads
John Saylor wrote:
Hi
I'd like to find an authentication protocol that fits my needs:
1. 2 [automated] parties
2. no trusted 3rd party intemediary ['Trent' in _Applied_Crypto_]
Most of the stuff in _Applied_Crypto_ requires that third party. It may
be an impossible task, nothing seems
Dan Geer wrote:
In the article they repeat the recommendation that you never
use/register the same shared-secret in different domains ... for
every environment you are involved with ... you have to choose a
different shared-secret. One of the issues of biometrics as a
This suffers from the same flaw as the last proposal: the security lies
in the idea that you can't store the data for long enough to be able to
decrypt the message that says where in the bitstream your data is.
However, this is defeatable by a delay line of sufficient length, just
like the last
Amir Herzberg wrote:
The `meet in the middle` attack works against double encryption; that's
why Triple DES is performing three DES operations with two keys.
Some variants use 3 keys, in fact.
Cheers,
Ben.
--
http://www.apache-ssl.org/ben.html http://www.thebunker.net/
There is no
marius wrote:
But there was an utterly trivial fix that DES users could employ if
they were worried
about security: they could simply encrypt each message twice, turning
56-bit DES into 112-bit DES, and squaring the number of key sequences
that
a code breaker would have to try. Messages
R. A. Hettinga wrote:
At 5:54 PM -0700 on 2/1/02, EDUCAUSE wrote:
DIGITAL WATERMARKING MAKES INTERNET VIDEO SPLASH
Purdue University researchers have found a way to ensure
Internet-delivered video maintains its watermark and keeps
channel disturbance to a minimum, protecting the
Bill Frantz wrote:
At 4:06 PM -0800 1/28/02, [EMAIL PROTECTED] wrote:
at least part of the fingerprint as a PIN ... isn't the guessing issue /or
false positives it is the forgetting issue (and the non-trivial number
of people that write their PIN on the card).
Or to state it another
P.J. Ponder wrote:
Without think about it some more, I don't know whether to place the entire
notion of security controls based on biometric telemetry in with _pure_
bullshit like copy protection, watermarking, non-repudiation, tamper
proofing, or trusted third parties. Admittedly, there is
David Honig wrote:
At 12:07 PM 1/27/02 -0500, Arnold G. Reinhold wrote:
if
an attacker had an agent working inside the organization that
produced the package, the agent could simply insert the Trojan
software patch in the original package. However such an insertion is
very risky. A
Trei, Peter wrote:
[Moderator's note: It wasn't a direct quote, and I generally assume
reporters misquote people anyway. Also, note that the general
confusion because the UK uses thousand million for the US billion
makes the whole thing even less clearly the expert and not the
reporter.
Eric Rescorla wrote:
Ben Laurie [EMAIL PROTECTED] writes:
Michael Sierchio wrote:
Carl Ellison wrote:
If that's not good enough for you, go to https://store.palm.com/
where you have an SSL secured page. SSL prevents a man in the middle
attack, right? This means your
Matt Crawford wrote:
David Honig wrote:
Unbeknown to the latter, Marks had already cracked General de Gaulle's
private cypher in a spare moment on the lavatory. -from the obit of Leo
Marks, cryptographer
But this was because it was, in fact, one of his own ciphers.
Cheers,
Nelson Minar wrote:
Of course, client side certificates barely even exist, although
people made substantial preparation for them early on in the history
of all of this.
I used to be puzzled by this. Then a couple of years ago I went
through the process of getting a client-side certificate
Steve Bellovin wrote:
A quantum computer has been built that has actually factored a number: 15.
It's not a very interesting number from a cryptographic perspective,
but it is real. http://www.nature.com/nature/links/011220/011220-2.html
Its worth noting that not only is the number not
[EMAIL PROTECTED] wrote:
Jay D. Dyson writes:
-BEGIN PGP SIGNED MESSAGE-
On Tue, 27 Nov 2001 [EMAIL PROTECTED] wrote:
Hrm, how about a worm with a built-in HTTP server that installs itself
on some non-standard port, say TCP/28462 (to pick one at random)?
Just came across this:
http://www.globalprivacysummit.net/
I notice a few of the Usual Suspects amongst the more blatant commercial
interests...
Cheers,
Ben.
--
http://www.apache-ssl.org/ben.html
There is no limit to what a man can do or how far he can go if he
doesn't mind who gets the
Roop Mukherjee wrote:
On Thu, 18 Oct 2001, Marc Branchaud wrote:
This analogy doesn't quite hold.
Copy protection need only be broken once for the protection to be disabled
for a particular piece of work. Also, once the scheme is known for one piece
of work, it is extremely easy
Marc Branchaud wrote:
This analogy doesn't quite hold.
Copy protection need only be broken once for the protection to be disabled
for a particular piece of work. Also, once the scheme is known for one piece
of work, it is extremely easy to break the scheme for other pieces, and in
Adam Back wrote:
Another framework is to have players which will only play content with
certified copy marks (no need for them to be visible -- they could be
encoded in a logo in the corner of the screen). The copymark is a
signed hash of the content and the identity of the purchaser.
Adam Back wrote:
In my opinion copymarks are evil and doomed to fail technically.
There always need to be playble non-certified content, and current
generation watermarks seem easy to remove; and even if some really
good job of spread spectrum encoding were done, someone would reverse
Matt Crawford wrote:
a) I believe physical media will always have higher bandwidth than
broadband - why? Because you have to feed the broadband from somewhere,
and archive it somewhere.
You can use an expensive physical medium to drive your transmission.
If you sell atoms, you have to
Trei, Peter wrote:
Windows XP at least checks for drivers not signed by MS, but
whose security this promotes is an open question.
Errr ... surely this promotes MS's bottom line and no-one's security? It
is also a major pain if you happen to want to write a device driver, of
course.
Cheers,
Carl Ellison wrote:
Declan,
we already have a national ID card: a passport.
Are you required to have one? Certainly in the UK its only required if
you want to leave the EU (though there are still some people manning the
borders that believe it is required for travel within the EU).
Ian Goldberg wrote something above this:
[Moderator's note: The best DES implementations for i386s in assembler
are several times faster than the best in C. I'm not sure about AES
but I'd prefer to try and see. Perhaps it's a feature of DES's odd bit
manipulation patterns, perhaps not. I have
Grant Bayley wrote:
--- begin forwarded text
Status: U
From: Julian Dibbell [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Subject: nettime Pirate Utopia, FEED, February 20, 2001
Date: Thu, 20 Sep 2001 08:37:20 -0500
Sender: [EMAIL PROTECTED]
Reply-To: Julian Dibbell [EMAIL
Bram Cohen wrote:
On Wed, 19 Sep 2001, Peter Fairbrother wrote:
Bram Cohen wrote:
You only have to do it once at startup to get enough entropy in there.
If your machine is left on for months or years the seed entropy would become
a big target. If your PRNG status is compromised
Greg Rose wrote:
At 12:44 AM 9/9/2001 -0400, Sandy Harris wrote:
Does using non-adaptive compression save the day?
Huffman coding using a fixed code table is not a bad way to go. You can
even peek at the characteristics of the input and choose a table based on
that... having standardised
John Kelsey wrote:
-BEGIN PGP SIGNED MESSAGE-
[ To: Perry's Crypto List ## Date: 09/08/01 07:35 pm ##
Subject: Field slide attacks and how to avoid them. ]
Guys,
I've been noticing a lot of ways you can mess up a cryptographic
protocol due to the sliding around of fields
Peter Wayner wrote:
b. I'm hoping to find out if anyone else has seen similar work
anywhere. I've not been able to find any references to this kind of
attack, though once you've had the idea to try it, it's really pretty
straightforward. (And I know there are a couple of occasional
Richard Schroeppel wrote:
It's time to consider moving the annual Crypto conference out of
Santa Barbara. The obvious places are Vancouver, Toronto, or
Mexico. I know zilch about these places as conference venues.
Could someone knowledgable summarize the relative merits?
How about
Declan McCullagh wrote:
Phil Zimmermann, Managing Director of the OpenPGP Alliance
And, err, Hush employee...
(www.openpgp.org) said, I am very encouraged by the support given to the
OpenPGP Alliance by founding members such as Hush Communications. As an
early adopter of the OpenPGP
Rich Salz wrote:
Oh? How? All you are suggesting is that the role key is held by a CA -
well, who is that going to be, then?
Unh, no. The same way the ASF determines who gets commit access could
be teh same way the ASF determines who their CA will give
release-signing keys to. The
V. Alex Brennen wrote:
In the case of such a large project, perhaps you could issue
a separate role key pair to each developer and generate
revocation certificates which are held by the core group for
those keys. When a developer leaves the group, the revocation
certificate for his key would
Philippe Coupe wrote:
Here is some answer to Ben Laurie legitimate questions (sorry for the delay
but I was off last week) ...
[...]They have chosen (by what process?) a thing called EPocketCash
(http://www.epocketcash.com/[1]) to do this[...]
JXTA neither SUN did not chose to implement
Enzo Michelangeli wrote:
- Original Message -
From: Greg Broiles [EMAIL PROTECTED]
To: Enzo Michelangeli [EMAIL PROTECTED]; [EMAIL PROTECTED]
Sent: Monday, June 25, 2001 1:32 AM
Subject: Re: crypto flaw in secure mail standards
[...]
The digital signature laws I've seen don't
Barry Wels wrote:
Hi,
In James Bamford's new book 'Body of Secrets' he claims the NSA is working on some
FAST computers.
http://www.randomhouse.com/features/bamford/book.html
---
The secret community is also home to the largest collection of hyper-powerful
computers, advanced
Kristen Tsolis wrote:
According to Nikkan Kogyo News, NTT is offering four patented algorithms
under royalty-free license for limited purposes.
These algorithms include Camellia, EPOC, PSEC, and ESIGN.
http://news.yahoo.co.jp/headlines/nkn/010418/nkn/08100_nkn13.html
NTT made
66 matches
Mail list logo
