Re: [NIIBE Yutaka] STM32F103 flash ROM read-out service

2018-06-06 Thread Leo Gaspard via Gnupg-users
On 06/06/2018 06:56 PM, NdK wrote: > Il 06/06/2018 17:49, Tom Li via Gnuk-users ha scritto: > >> BTW, BasicCard and JavaCard seemed even more obscure and I cannot find >> any public service of cracking. > Because those are (at least should be) based on secure chips. > >> But it does not solve

Re: STM32F103 flash ROM read-out service

2018-06-06 Thread Damien Goutte-Gattat via Gnupg-users
On 06/06/2018 08:50 PM, Philipp Klaus Krause wrote: > See https://www.aisec.fraunhofer.de/en/FirmwareProtection.html for > some research on breaking STM32 readout protection published in > January. For what it's worth, STMicroelectronics claims that the attack described in this paper "affects

Re: STM32F103 flash ROM read-out service

2018-06-06 Thread Philipp Klaus Krause
Am 05.06.2018 um 02:37 schrieb NIIBE Yutaka: > Hello, > > While learning Chinese language, I found this service (in Chinese): > > http://www.pcbcopy.com/2016/ic_1128/1928.html > > IIUC, It's a company in ShenZhen, which offers a service reading out > from protected STM32F103, even if it

Re: efail is imho only a html rendering bug

2018-06-06 Thread Werner Koch
Hi! Thanks for responding. However, my question was related to the claims in the paper about using CRL and OCSP as back channels. This created the impression that, for example, the certificates included in an encrypted CMS object could be modified in a way that, say, the DP could be change in

Re: STM32F103 flash ROM read-out service

2018-06-06 Thread Tom Li via Gnupg-users
Relevant discussion is moved to [gnuk-users], but in case someone has seen the first mail in [gnupg-users] but missed other mails, I've reposted the mail, sorry for the double post. Follow-up discussion should be sent to [gnuk-users]. - > While learning Chinese language, I found this

Re: [NIIBE Yutaka] STM32F103 flash ROM read-out service

2018-06-06 Thread Tom Li via Gnupg-users
> While learning Chinese language, I found this service (in Chinese): > > http://www.pcbcopy.com/2016/ic_1128/1928.html > > IIUC, It's a company in ShenZhen, which offers a service reading out > from protected STM32F103, even if it uses anti-tamper feature with a > battery. > > I was aware

Re: doc patches: spelling errors

2018-06-06 Thread Werner Koch
Hi! Thanks for the fixes. I applied them to master and 2.2 > +++ gnupg.info-1 Sat May 19 19:02:04 2018 Noet that this is a generated file. The source is one of the *texi files. Shalom-Salam, Werner -- # Please read: Daniel Ellsberg - The Doomsday Machine # Die Gedanken sind

Re: efail is imho only a html rendering bug

2018-06-06 Thread Werner Koch
On Mon, 21 May 2018 19:11, r...@sixdemonbag.org said: > Efail is not just an HTML rendering bug. It includes very real > attacks against S/MIME as it's used by thousands of corporations. I have not yet seen any hints on how a back-channel within the S/MIME protocol can work. There are claims

Re: Breaking changes

2018-06-06 Thread Werner Koch
On Wed, 23 May 2018 15:45, m16+gn...@monksofcool.net said: > 1. GPG is maintained by volunteers. If you have any complaint about how > this maintenance is progressing, get off your behind and be a volunteer That is fortunately not true. I work full time on GnuPG and related software, Gniibe is

end-of-life announcements (was: Breaking changes)

2018-06-06 Thread Werner Koch
On Wed, 23 May 2018 13:56, d...@kegel.com said: >> So when talking about EOL, gpg community should consider writing down a >> consistent EOL strategy, similar to those of Ubuntu, Linux kernel or others >> or something like I tried to argue for in the middle of >>

Invitation to the 4th OpenPGP Email Summit

2018-06-06 Thread Patrick Brunschwig
I'm happy to announce the 4th OpenPGP Email Summit which will take place Saturday, October 20 until Sunday, October 21, 2018 in Brussles (Belgium). This is an event open for anybody involved in the development of email clients using OpenPGP for encryption, and related software. In 2015 and