Re: Open Source Embedded SSL - Export Questions

2003-11-26 Thread Bill Tompkins
On Mon, 2003-11-24 at 21:06, J Harper wrote: ...snip... We're not looking for official legal advice, just some pointers to current online resources of how to go about registering our product in the US. I've seen posts that for SSL implementations you just need to send a letter to the

Re: Cryptophone locks out snoopers

2003-11-26 Thread Dave Howe
Ian Grigg wrote: (link is very slow:) http://theregister.co.uk/content/68/34096.html Cryptophone locks out snoopers By electricnews.net Posted: 20/11/2003 at 10:16 GMT I see the source release has been put back... again.

Re: Open Source Embedded SSL - Export Questions

2003-11-26 Thread J Harper
Thanks. Pretty simple for open source code. Single email to two addresses once we have code available online. http://www.bxa.doc.gov/Encryption/pubavailencsourcecodenofify.html (yes, notify is spelled wrong) What about the patent/trademark issues? - Original Message - From: Sidney

Re: Open Source Embedded SSL - Export Questions

2003-11-26 Thread Rich Salz
We've implemented a small version of SSL that we plan to release as open source by year's end. Great! We're not looking for official legal advice, just some pointers to current online resources of how to go about registering our product in the US. http://www.bxa.doc.gov/Encryption; Google

Re: Open Source Embedded SSL - Export Questions

2003-11-26 Thread Steven M. Bellovin
In message [EMAIL PROTECTED], J Harper writes: SSLv3 protocol implementation Simple ASN.1 parsing Cipher suites: TLS_RSA_WITH_RC4_128_MD5 TLS_RSA_WITH_RC4_128_SHA TLS_RSA_WITH_3DES_EDE_CBC_SHA I understand the need to conserve space; that said, I strongly urge you to consider AES as

lockable trapdoor one-way function

2003-11-26 Thread Peter Fairbrother
Does anyone know of a trapdoor one-way function whose trapdoor can be locked after use? It can be done with secure hardware and/or distributed trust, just delete the trapdoor key, and prove (somehow?) you've deleted it. It looks hard to do in trust-the-math-only mode... -- Peter Fairbrother

Re: Open Source Embedded SSL - Export Questions

2003-11-26 Thread Thor Lancelot Simon
On Wed, Nov 26, 2003 at 02:56:40PM -0800, J Harper wrote: Great feedback, let me elaborate. I realize that AES is implemented in hardware for many platforms as well. I'll mention a bit more about our cryptography architecture below. Do you know why AES is so popular in embedded? ARC4 is

Re: Open Source Embedded SSL - Export Questions

2003-11-26 Thread Sidney Markowitz
As a separate issue from whether you want to implement AES, if you do decide to implement it look at Brian Gladman's code at http://fp.gladman.plus.com/cryptography_technology/rijndael/ It is the fastest free implementation of AES that I know of, and has a good history and credentials behind

RE: Open Source Embedded SSL - (AES)

2003-11-26 Thread J Harper
I've just taken a look. This OCB mode for AES looks really interesting. Encryption and MAC in one pass! Wait, OCB is patented. That's not in the spirit of AES :-) I suppose one could do a user defined cipher suite for AES OCB, if both client and server knew about it. Anyway... must focus on