Re: skype not so anonymous...

2006-09-04 Thread Marcos el Ruptor
One thing is possible with Skype: any user can easily obtain any other user's IP address (actually both internal and external IPs). Those users don't even need to be on his contact list. Of course one would need cracking tools or a decrypted patched Skype executable with all the 288 integrity

signing all outbound email

2006-09-04 Thread Travis H.
Has anyone created hooks in MTAs so that they automagically sign outbound email, so that you can stop forgery spam via a SRV DNS record? -- If you're not part of the solution, you're part of the precipitate. Unix guru for rent or hire -- http://www.lightconsulting.com/~travis/ GPG fingerprint:

Re: Debunking the PGP backdoor myth for good. [was RE: Hypothesis: PGP backdoor (was: A security bug in PGP products?)]

2006-09-04 Thread Leichter, Jerry
| On 8/28/06, Ondrej Mikle [EMAIL PROTECTED] wrote: | Take as an example group of Z_p* with p prime (in another words: DLP). | The triplet (Z, p, generator g) is a compression of a string of p-1 | numbers, each number about log2(p) bits. | | Pardon my mathematical ignorance, but isn't Z just a

IGE mode in OpenSSL

2006-09-04 Thread Ben Laurie
I've added IGE mode to OpenSSL - it should be in the next release (0.9.8c). More info here: http://www.links.org/?p=131. Including test vectors! Cheers, Ben. -- http://www.apache-ssl.org/ben.html http://www.links.org/ There is no limit to what a man can do or how far he can go if

Re: IGE mode in OpenSSL

2006-09-04 Thread Travis H.
Nevermind the algorithm, I saw the second PDF. For the other readers, the algorithm in more standard variable names is: c_i = f_K(p_i xor c_(i-1)) xor p_(i-1) IV = p_(-1), c_(-1) I suppose the dependency on c_(i-1) and p_(i-1) is the part that prevents the attacker from predicting and

Re: IGE mode in OpenSSL

2006-09-04 Thread Travis H.
The NIST server is down. Care to post the algorithm? By the term crib do you mean a known-plaintext? I'd like to see a proof that it is not possible to alter the final block to make it decrypt to all zeroes; that seems worse than CRCs and putting a CRC at the end of the plaintext is a common,

Re: signing all outbound email

2006-09-04 Thread Jon Callas
On 4 Sep 2006, at 4:13 AM, Travis H. wrote: Has anyone created hooks in MTAs so that they automagically sign outbound email, so that you can stop forgery spam via a SRV DNS record? Take a look at DKIM (Domain Keys Identified Mail) which does precisely that. There is an IETF working group

Re: skype not so anonymous...

2006-09-04 Thread John Ioannidis
Although in this case it's obviously the man's stupidity using an instant messenger with his old virtual identity that got him tracked down. No one For that matter, he could just have gotten a phonecard and used a payphone. Wearing sunglasses, a wig and a false beard while limping to and