Re: Two-factor auth for Bugzilla

2011-02-01 Thread aerowolf
On Tue, Feb 1, 2011 at 1:19 PM, Marsh Ray wrote: On 02/01/2011 02:41 PM, Anders Rundgren wrote: What about the client cert in a smart card? That's old and standard and supported by Mozilla. I don't know what kind of prices you'd have to pay for small quantities though. $119 if you go with

Re: Two-factor auth for Bugzilla

2011-02-01 Thread aerowolf
On Tue, Feb 1, 2011 at 12:02 PM, Marsh Ray wrote: can meet the requirement of "implement it only for some accounts" (with the implicit requirement that it doesn't bother or affect people who are not using it). Can a client certificate solution be made to work? Those accounts would probably h

Re: Two-factor auth for Bugzilla

2011-02-01 Thread Robert Relyea
On 02/01/2011 12:02 PM, Marsh Ray wrote: > On 02/01/2011 10:56 AM, Gervase Markham wrote: >> Dear crypto-hackers, >> >> Your thoughts on the following problem would be appreciated. >> >> Goal: fix bug 570252. Provide 2-factor authentication for some Bugzilla >> accounts. >> https://bugzilla.mozilla

Re: Two-factor auth for Bugzilla

2011-02-01 Thread Marsh Ray
On 02/01/2011 02:41 PM, Anders Rundgren wrote: Gervase, The ability to use a chip as holder of credentials for on-line providers like Bugzilla is unlikely to happen in a major way until there is an open solution for getting keys down into the chip/container that is: 1. Usable by non-experts 2.

Re: Two-factor auth for Bugzilla

2011-02-01 Thread Anders Rundgren
Gervase, The ability to use a chip as holder of credentials for on-line providers like Bugzilla is unlikely to happen in a major way until there is an open solution for getting keys down into the chip/container that is: 1. Usable by non-experts 2. Is secure in such a way that banks could use it

Re: Two-factor auth for Bugzilla

2011-02-01 Thread Marsh Ray
On 02/01/2011 10:56 AM, Gervase Markham wrote: Dear crypto-hackers, Your thoughts on the following problem would be appreciated. Goal: fix bug 570252. Provide 2-factor authentication for some Bugzilla accounts. https://bugzilla.mozilla.org/show_bug.cgi?id=570252 Sub-goal: do it in a way which

Re: Support for TLS snap start and next-protocol-negotiation extensions in NSS

2011-02-01 Thread Wan-Teh Chang
On Mon, Jan 31, 2011 at 1:55 AM, mandeep alluru wrote: > Hello Everyone, > > I am new to using NSS and have been exploring the features of NSS for > the past two weeks. I would like to know if NSS supports TLS Next- > Protocol-Negotiation and TLS snap start extensions. I would be glad if > you giv

TLS server keys in DNS: client policy proposal

2011-02-01 Thread Zack Weinberg
[Some of you may have seen an earlier draft of this proposal before. I originally sent it to secur...@mozilla.org and was asked to bring it here.] I've been following the mailing list for the IETF's "keyassure" working group, which plans to standardize a mechanism for putting application-layer

{Filename?} Re: certutil -D corrupting NSS database...

2011-02-01 Thread Michael H. Warfield
Warning: This message has had one or more attachments removed Warning: (gorgon10.wittsend.com.p12). Warning: Please read the "WittsEnd-Attachment-Warning.txt" attachment(s) for more information. Hey hey... On Sun, 2011-01-30 at 04:12 -0800, Nelson B Bolyard wrote: > Michael, > Can you make avai

TLS server keys in DNS: client policy proposal

2011-02-01 Thread Zack Weinberg
[Some of you may have seen an earlier draft of this proposal before. I originally sent it to secur...@mozilla.org and was asked to bring it here.] I've been following the mailing list for the IETF's "keyassure" working group, which plans to standardize a mechanism for putting application-layer

Support for TLS snap start and next-protocol-negotiation extensions in NSS

2011-02-01 Thread mandeep alluru
Hello Everyone, I am new to using NSS and have been exploring the features of NSS for the past two weeks. I would like to know if NSS supports TLS Next- Protocol-Negotiation and TLS snap start extensions. I would be glad if you give me some information in this regard. - Mandeep -- dev-tech-crypt

Re: S/MIME encrypted e-mails

2011-02-01 Thread Michael Ströder
Matej Kurpel wrote: > as far as I know, Thunderbird sends encrypted e-mails as an attachment > named "smime.p7m". Not attachement. The whole body is base64-encoded. Look closely at the message headers. > Can anybody let me briefly know what this file contains? The CMS (formerly PKCS#7) blob. >

Re: Two-factor auth for Bugzilla

2011-02-01 Thread Matej Kurpel
On 1. 2. 2011 17:56, Gervase Markham wrote: Dear crypto-hackers, Your thoughts on the following problem would be appreciated. Goal: fix bug 570252. Provide 2-factor authentication for some Bugzilla accounts. https://bugzilla.mozilla.org/show_bug.cgi?id=570252 Sub-goal: do it in a way which d

Two-factor auth for Bugzilla

2011-02-01 Thread Gervase Markham
Dear crypto-hackers, Your thoughts on the following problem would be appreciated. Goal: fix bug 570252. Provide 2-factor authentication for some Bugzilla accounts. https://bugzilla.mozilla.org/show_bug.cgi?id=570252 Sub-goal: do it in a way which doesn't involve purchasing or running proprie

Re: Encoding and comparing certificates with NSS

2011-02-01 Thread Ambroz Bizjak
On Feb 1, 12:45 am, Robert Relyea wrote: > If I were you, I'd double check my byte compare code in B. Try > connecting to A with one cert and to B with another and make sure it > fails. In our previous example, you clearly had a mangled version of > certificate C sent to be, but you indicated tha