Cryptography-Digest Digest #409, Volume #10 Thu, 14 Oct 99 02:13:02 EDT
Contents:
Re: KRYPTOS AGAIN (Bill)
Re: Does anyone know a good listserver for cryptography (Arthur Dardia)
Re: Is 128 bits safe in the (far) future? ("Trevor Jackson, III")
Re: --- sci.crypt charter (David A Molnar)
Re: "Risks of Relying on Cryptography," Oct 99 CACM "Inside Risks" column (Sundial
Services)
Re: Should RC4 be free? ("Roger Schlafly")
Re: Better than Diffie-Hellman? (DJohn37050)
Re: where to put the trust ("Douglas A. Gwyn")
Re: "Risks of Relying on Cryptography," Oct 99 CACM "Inside Risks" ("Douglas A.
Gwyn")
Re: Newbie questions ("Douglas A. Gwyn")
Re: There could be *some* truth to it ("Douglas A. Gwyn")
Re: A viable security strategy (and looking for off-the-shelf product) (jerome)
A Question About DC-nets ("Aaron Swartz")
Re: Stop others from using your computer!!! 7520 ("Trevor Jackson, III")
Classical Crypto Books (CryptoBook)
Re: Factoring public keys attack? (Jerry Coffin)
Re: Layperson Q: how long to crack 32-bit RSA? (Jerry Coffin)
Re: Patent Free Public Key Encryption (Jerry Coffin)
Re: Crypto 1981-1997 CD-ROM fix (CryptoBook)
Re: A viable security strategy (and looking for off-the-shelf product) (Paul Rubin)
----------------------------------------------------------------------------
From: Bill <[EMAIL PROTECTED]>
Subject: Re: KRYPTOS AGAIN
Date: Wed, 13 Oct 1999 18:48:10 -0400
"Douglas A. Gwyn (IST/CNS)" wrote:
> Bill wrote:
> > "Douglas A. Gwyn (IST/CNS)" wrote:
> > > collomb wrote:
> > > >... This enigma was conceived to be able to be solved even by
> > > > non-cryptographers, ...
> > > To the contrary, the sculptor was quoted as saying that he didn't
> > > think it would ever be solved.
> > Actually, Scheidt thought it would be solved in 10 years.
>
> But he wasn't the sculptor.. Neither Sanborn nor Scheidt has
> ever indicated (to my knowledge) that Kryptos was supposed to
> be solved by non-cryptographers. I'm pretty sure Scheidt knew
> that it was within the abilities of a classically-trained
> cryptanalyst.
Oops, you're right on that. Got my quotes mixed.
I don't think the solution is limited to cryptographers, but a non-crypto
would have to do some research to get it. Research into cryptography
that is, and not whatever "collomb" researched for that gibberish URL.
------------------------------
From: Arthur Dardia <[EMAIL PROTECTED]>
Subject: Re: Does anyone know a good listserver for cryptography
Date: Wed, 13 Oct 1999 19:31:21 -0400
I believe someone said something about a web archive of this news-group being
available. You can check there, or you can write a perl script and have it
run on a cron job to continually check the archive page (depending on how
freq. updated it is), and have it email the new posts to you - effectively
turning this newsgroup into a listserv. Or, you could just goto www.deja.com
and search.
"j.w.altena" wrote:
> At my office I have no access to this newsgroup. Only a subcription to a
> listserver is possible. Does anyone know a good one for cryptograhpy (same
> topics as in this newsgroup) ?
>
> Jan Willem Altena
--
Arthur Dardia Wayne Hills High School [EMAIL PROTECTED]
PGP 6.5.1 Public Key http://www.webspan.net/~ahdiii/ahdiii.asc
------------------------------
Date: Wed, 13 Oct 1999 20:02:22 -0400
From: "Trevor Jackson, III" <[EMAIL PROTECTED]>
Subject: Re: Is 128 bits safe in the (far) future?
Tim Tyler wrote:
> SCOTT19U.ZIP_GUY <[EMAIL PROTECTED]> wrote:
>
> : But it is interesting that medical science has rather recently made
> : use to the fact that the DNA of the mitocohria (piss poor splleing I;m sure)
> : is only passed from the mother to her kids and that fathers plays no
> : roll in this DNA transmission. So in many ways it makes more
> : sense to basically follow the womans link.
>
> Y-chromosomes are passed down only through the father, so in many ways
> it makes more sense to basically follow the man's link.
Hmmm. This makes it _extremely_ difficult to determine the ancestry of a lady.
:-|
>
>
> Um, so breaking the code after a few centuries have passed to reveal the
> true relationship ... ah, forget it ;-)
> --
> __________
> |im |yler The Mandala Centre http://www.mandala.co.uk/ [EMAIL PROTECTED]
>
> Never ever use repetitive redundancies.
------------------------------
From: David A Molnar <[EMAIL PROTECTED]>
Subject: Re: --- sci.crypt charter
Date: 13 Oct 1999 23:44:53 GMT
Douglas A. Gwyn (IST/CNS) <[EMAIL PROTECTED]> wrote:
> Funny, we don't have much problem finding real-world applications for it
> here. For example: If you send a detachment to a foreign country, quite
> often its communications are subject to controls that prohibit use of
> cryptography. In which case, you must "smuggle" your secret information
> over open channels without it being detected by the foreign monitors.
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Finding applications doesn't seem to be the problem. Reasoning about what
"being detected" means, even when the foreign monitors can inspect many of
your detachments over time, seems to be.
I mean, you can presumably encrypt your data and get output which is
indistinguishable from random -- now what are you going to carry it in?
and how do you know that it won't raise suspicion?
-David
------------------------------
Date: Wed, 13 Oct 1999 17:42:43 -0700
From: Sundial Services <[EMAIL PROTECTED]>
Reply-To: [EMAIL PROTECTED]
Subject: Re: "Risks of Relying on Cryptography," Oct 99 CACM "Inside Risks" column
[EMAIL PROTECTED] wrote:
>
> If they do that, the AES program will be a collossal failure.
> They would have to rename it from Advanced Encryption Standard
> to Advanced Encryption Removal Of Excessive Diversity Of Choice.
> AEROEDOC, for short.
>
Seems to me that being an AES finalist makes yours a pretty darn good
crypto-system, worthy of consideration, and that being selected as
"numero uno" means only that "if you HAVE to choose just one ..."
------------------------------
From: "Roger Schlafly" <[EMAIL PROTECTED]>
Subject: Re: Should RC4 be free?
Date: Wed, 13 Oct 1999 16:53:05 -0700
Sundial Services <[EMAIL PROTECTED]> wrote in message
news:[EMAIL PROTECTED]...
> So what's so infernally wrong, anyway, with the idea that a really great
> algorithm, well-implemented, is something that you should pay for?
Nothing. If you want to use someone's implementation of RC4,
you should pay his price for it. But if the price is too high, there
are also public domain implementations that you can use for free.
------------------------------
From: [EMAIL PROTECTED] (DJohn37050)
Subject: Re: Better than Diffie-Hellman?
Date: 14 Oct 1999 01:08:07 GMT
See IEEE P1363.
Don Johnson
------------------------------
From: "Douglas A. Gwyn" <[EMAIL PROTECTED]>
Subject: Re: where to put the trust
Date: Thu, 14 Oct 1999 01:16:12 GMT
Patrick Juola wrote:
> ... Yes, chemists make mistakes. But that doesn't mean
> that it's foolish to believe the results of chemical assay.
That's because chemistry is solid science, whereas expert
public cryptographer opinion is very mushy science at best.
If a chemist said such things as "I don't know what's in
that vial, but I guess it's amyl nitrate because nobody has
yet published any paper saying otherwise," you'd think he
was incompetent.
------------------------------
From: "Douglas A. Gwyn" <[EMAIL PROTECTED]>
Subject: Re: "Risks of Relying on Cryptography," Oct 99 CACM "Inside Risks"
Date: Thu, 14 Oct 1999 01:25:19 GMT
"SCOTT19U.ZIP_GUY" wrote:
> But since you brought this crap up what was this great trick
> they used ore are you going to pretend it was som secret
> shit they chose to share with only you and not the rest
> of the lowly people.
I don't think Bruce should deign to respond to such invective,
but I'll happily give a representative example:
Jam the receiver while capturing the transmission. Then allow
the retransmission to go through, while capturing it also.
If you're lucky, you now have in your possession the exact same
plaintext encrypted with consecutive stretches of the keying
cycle. For some systems, that is enough to mount a successful
cryptanalysis. From the academic perspective, that doesn't fit
their model of how {Alice,Bob,Eve} operate, so it's "cheating".
------------------------------
From: "Douglas A. Gwyn" <[EMAIL PROTECTED]>
Subject: Re: Newbie questions
Date: Thu, 14 Oct 1999 01:31:36 GMT
Dan Fogelberg wrote:
> So I am only going to recieve encrypted text. He assures me it is
> English language and words. How do I find the period. Do I run a
> kappa test on it?
There is no "recipe" for cryptanalysis. If you're going to keep
playing this game, you need to study the subject. I recommend
Kahn's "The Codebreakers" (unabridged hardbound) followed by the
MilCryp series (see the sci.crypt FAQ); work through the Zendian
problem and you should be in a good position to tackle the kind
of systems your friend seems to be coming up with. If you later
need to move on to "modern" digital systems, there are other
useful textbooks (also mentioned in sci.crypt FAQ).
------------------------------
From: "Douglas A. Gwyn" <[EMAIL PROTECTED]>
Subject: Re: There could be *some* truth to it
Date: Thu, 14 Oct 1999 01:35:30 GMT
Ian Woollard wrote:
> Show me a computer that can compute an arbitrarily long
> sequence or an unlimited number of bits. Turing machines
> are NOT counted (unless you have a working example ;-).
Surely you jest. For example, compute the nth hex digit
of pi, for n = 1, 2, 3, ... And no, it doesn't require an
infinite amount of storage, although just to hold a standard
representation of n one needs gradually more and more bits.
But any reasonable-sized computer could still be cranking
out the successive digits long after we're all gone.
------------------------------
From: [EMAIL PROTECTED] (jerome)
Subject: Re: A viable security strategy (and looking for off-the-shelf product)
Reply-To: [EMAIL PROTECTED]
Date: Thu, 14 Oct 1999 03:08:26 GMT
On Wed, 13 Oct 1999 18:19:28 -0400, Adam Durana wrote:
>With TCP, IP spoofing is no longer practical. On most modern operating
>systems sequence prediction is pretty much impossible.
it depends what do you call 'practical' but there is at least 2 ways
to do it in real world, now, with modern operating systems. Nothing
new there, it is described in the rfc series.
so if SSL is vulnerable to a 'man in the middle', it is feasable and
if i had to, i would do it close to a popular ecommerce site :)
><[EMAIL PROTECTED]> wrote in message news:7u2nbo$7i3$[EMAIL PROTECTED]...
>> I'm working on a system where we need to be able to hand off control
>> from one web site to another securely. So the plan is to have the
>> hand-off procedure on site A contact site B to retrieve the appropriate
>> session variables for hand-off. However, to guard against IP spoofing
>> attacks, what I'd like to do is have site B return some piece of text
>> which needs to be returned to it by site A using some encryption method.
>> The theory being that in this way we can be relatively sure that we're
>> getting a valid login request.
>>
>> I'm assuming that this would have to be some sort of private key
>> encryption scheme & that for maximum security, site B should supply a
>> new private key to site A periodically.
>>
>> So (a) does this seem like a workable solution
yes.
You seems to have only 2 web sites involved so if you have a secure channel
to exchange a public key (e.g. you with a floppy from one site to the other)
you probably can be as secure as you need.
>> (b) is there some
>> off-the-shelf library that'll handle the encryption duties (it needs to
>> run under both Windows and Unix)?
IPSec can handle that but probably overkill for your needs.
maybe ssh or cryptolib, i don't know these softwares, just a wild guess.
------------------------------
From: "Aaron Swartz" <[EMAIL PROTECTED]>
Subject: A Question About DC-nets
Date: Thu, 14 Oct 1999 03:14:58 GMT
Are there any good sources for information on DC-nets? I've read all the
usual suspects: The Chaum Paper; Dining Cryptographers at the Disco; Applied
Cryptography. Has there been any work done on creating one? Any information
you can provide would be greatly appreciated.
Thanks,
Aaron Swartz <[EMAIL PROTECTED]>|<http://swartzfam.com:81/go/echelon>
<http://www.swartzfam.com/aaron/>|Digital Nuclear Bomb to hit Echelon
<http://www.notabug.com/aaron/> |Inciting Crypto Anarchy with DigiCash
ICQ: 33158237 | AIM: Jedi of Pi |Tapping civilian communications
------------------------------
Date: Wed, 13 Oct 1999 23:20:24 -0400
From: "Trevor Jackson, III" <[EMAIL PROTECTED]>
Subject: Re: Stop others from using your computer!!! 7520
[EMAIL PROTECTED] wrote:
> That's right....stop others from using your computer now!
> Desktop Blocker will password protect your Windows system so that nobody except for
>you will be able to access your desktop.
> Keep that co-worker off your computer, keep the babysitter off the Internet, and
>keep the wife from discovering your "collection"(you shouldn't be looking at that
>stuff anyway).
> Desktop Blocker is a FREE download at: http://www.eggman.net/desktopblocker
> Take a couple seconds to view our SCREENSHOT:
> http://www.eggman.net/software/dbss.htm
> Lock-up your desktop today!!!
> -EggMan Network
How sad.
------------------------------
From: [EMAIL PROTECTED] (CryptoBook)
Subject: Classical Crypto Books
Date: 14 Oct 1999 03:33:29 GMT
Classical Crypto Books is pleased to announce the following recent
additions/updates to the CCB catalog. All items are available now.
FICTION AND LITERATURE
EMILY DICKINSON'S SECRET LOVE: Mystery "Master" Behind Poems
by Bill Arnold
The author contends that Ms. Dickinson had a secret lover, whose identity she
hid in her poems using acrostics and anagrams. This book will appeal to all
lovers
of Miss Emily's poetry, and to anyone with an interest in literary detective
work.
Autographed copies. PPB Press, 228 pp.
SB, Nonmember $19.95, Member $16.95
FOR BEGINNERS AND ENTHUSIASTS
SECRET CODE BREAKER SECRET MESSAGE KIT: Second Edition
by Robert Reynard
A hands-on activity kit with two different cardboard cipher disks, including
the
Mexican Army disk. Also included are five different cipher system message pads,
a
secret ink marker pen, a separate developer marker, and step by step
instructions.
Smith & Daniel Marketing, 28 pp.
Nonmember $9.95, Member $8.95
CLASSICAL CRYPTO
SECRET CODES: Real-World Mathematics Through Science
by Nancy Cook
Middle school teaching module. Lessons for additive, affine, and Vigenere
ciphers;
modular arithmetic, multiplicative shifts, prime numbers, & one time pads. Has
1-
page links to history, interests, careers, technology, & writing. Exercises
with
answers. Dale Seymour Publications, 152 pp.
SB, Nonmember $18.95, Member $16.95
ELEMENTARY COURSE IN PROBABILITY FOR THE CRYPTANALYST: Revised
Edition
by Andrew M. Gleason, Walter F. Penney, Ronald E. Wyllys
Originally developed by LCDR Gleason to supplement a series of lectures on
probability given to U.S. cryptanalysts during WW2 . Later revised by the
coauthors.
Contains many solved examples and exercises. Aegean Park Press C-41, 174 pp.
SB, Nonmember $24.80, Member $19.85
STATISTICAL METHODS IN CRYPTANALYSIS: With New Added Problems for the
Student
by Solomon Kullback
Written by one of America's pioneering cryptanalytic superstars, this monograph
has long been recognized as a classic in its field; formerly classified.
Aegean Park Press C-4, 212 pp.
SB, Nonmember $25.80, Member $20.65
CLASSICAL CRYPTOGRAPHY COURSE, VOLUME I
by Randall K. Nichols
Written by a past president of the American Cryptogram Association; based on an
enormously successful Internet course taken by 390 students worldwide. Contains
updated and corrected versions of the first ten lectures.
Aegean Park Press C-74, 313 pp.
SB, Nonmember $34.80, Member $27.85
CLASSICAL CRYPTOGRAPHY COURSE, VOLUME II
by Randall K. Nichols
Continuation of the author's highly acclaimed course; contains updated and
corrected versions of lectures 11 through 22. Includes a glossary, a
comprehensive
bibliography, and an annotated list of World Wide Web resources.
Aegean Park Press C-76, 466 pp.
SB, Nonmember $40.80, Member $32.65
HISTORY
WAR BY STEALTH: Australians and the Allied Intelligence Bureau 1942-1945
by Alan Powell
Intelligence operations behind Japanese lines were part of the Allied
Strategy--a war
by stealth. It took courage, endurance, and great endeavor from the
participants. This is their story. Published at $62.95. Melbourne University
Press, 444 pp.
HB, Nonmember $58.95, Member $55.95
THE VICTORIAN INTERNET: The Remarkable Story of The Telegraph and the
Nineteenth Century's On-line Pioneers
by Tom Standage
The author's premise: As we marvel at all the exciting new developments made
possible by the Internet, we should remember that the impact of the telegraph
on society then was much greater. Chapter 7 discusses how it spurred
developments
in cryptology. Published at $22.00.
Walker Publishing Company, 239 pp.
HB, Nonmember $18.95, Member $16.95
MODERN AND ADVANCED CRYPTO
CRYPTANALYSIS OF SHIFT-REGISTER GENERATED STREAM CIPHER
SYSTEMS
by Wayne G. Barker
Introduces shift-register generated stream ciphers, their cryptanalytic
solution and,
indirectly, their generation. The goal is to teach cryptanalytic principles
rather than
focus on specific cipher machines. Contains 20 computer programs in BASIC.
Aegean Park Press C-39, 257 pp.
SB, Nonmember $48.80, Member $39.05
SHIFT REGISTER SEQUENCES: Revised Edition
by Solomon W. Golomb, Lloyd R. Welch, Richard M. Goldstein, Alfred W. Hales
"The purpose of this book is to collect and present in a single volume a
thorough
treatment of both the linear and nonlinear theory, with a guide to the area of
application, and a full bibliography of the related literature." -- from the
preface.
Aegean Park Press M-5, 263 pp.
SB, Nonmember $34.80, Member $27.85
MATHEMATICAL CRYPTOLOGY: for Computer Scientists and Mathematicians
by Wayne Patterson
Contents: classical crypto, DES, public keys, knapsacks, RSA algorithm,
breaking
knapsacks, Chor-Rivest algorithm, other security problems, standardization, DES
cryptanalysis. Appendices: groups, number theory, complexity, Galois fields,
Pascal programs. Published at $68.00. Rowman & Littlefield, 336 pp.
HB, Nonmember $52.95, Member $49.95
=============
HB = Hardbound
SB = Softbound
=============
Member prices are available to members of the American Cryptogram
Association, the U.S. Naval Cryptologic Veterans Association, and full time
students. Shipping and handling are extra. For complete ordering information,
a free catalog of crypto books by return e-mail, or for information about
membership in the American Cryptogram Association, please send email to:
[EMAIL PROTECTED]
Best Wishes,
Gary
Gary Rasmussen
Classical Crypto Books
E-Mail: [EMAIL PROTECTED]
Fax: (603) 432-4898
------------------------------
From: [EMAIL PROTECTED] (Jerry Coffin)
Subject: Re: Factoring public keys attack?
Date: Wed, 13 Oct 1999 22:09:38 -0600
In article <19991013151854.334$[EMAIL PROTECTED]>, [EMAIL PROTECTED]
says...
[ ... ]
> At most, wouldn't that only double the number of primes to examine?
>
> So 10^74 would become 2*10^74 or 10^74.3? And the combinations would
> be 10^148.6?
If you add one more bit in each direction, that should (unless I'm
missing something) roughly double the number of possible factors.
Each bit of difference you add should roughly double the number of
factors -- if you start with something like a 1024 bit key, then
varying the sizes of the factors by, say, 10 bits shouldn't cause a
problem, and will multiply the number of factors by roughly three
orders of magnitude...
--
Later,
Jerry.
The universe is a figment of its own imagination.
------------------------------
From: [EMAIL PROTECTED] (Jerry Coffin)
Subject: Re: Layperson Q: how long to crack 32-bit RSA?
Date: Wed, 13 Oct 1999 22:09:23 -0600
In article <7u2ia0$3f4$[EMAIL PROTECTED]>, [EMAIL PROTECTED]
says...
> So what do you all make of the claim that Access encrypts each 2k page
> individually, using a unique key? Do I understand it right that the
> compute times y'all are talking about apply to a single 2k page & that
> decrypting an entire file would take [however long it takes to crack 32-
> bit RC4] * [the # of 2k pages]?
You've got that absolutely correct -- the time involved is for a
single key, not for whatever number of keys is used in the entire
file.
> Or are you already taking that into account?
No.
> [Maybe something in the RC4 algorithm generates the keys
> systematically, so that once you've got one you can derive the rest?]
RC4 itself merely uses keys, it doesn't generate them. The method
they're using to generate keys could itself have patterns that could
be detected, in which case finding one could lead to the rest.
Problems in generating "random" keys have been found in the past --
e.g. some old versions of Netscape had a problem where parts of the
"random" session key used with SSL could be guess fairly easily.
> P.S. All this thinking about code-breaking makes me wonder--if I were
> to take a file of randomly generated on/off bits, encrypt it & invite
> others to try and crack the encryption, how would you know when you've
> successfully cracked the code & you can stop decrypting?
If the bits are truly random to start with, there's no way to figure
out unless you have something like a method of getting at least a
little bit of known data encrypted so you know when it's decrypted
correctly.
In reality, it's fairly rare that this is a problem unless something
like compression has been done before the data is encrypted. In
typical English text (for one example) there are enough patterns that
it's typically pretty easy to detect when you've got a correct
decryption. In other cases it can get more difficult, but you've
still typically got at least a few patterns that tell you when a
decryption is correct.
In the case of Access, it'd be interesting to know whether they
encrypt the entire file or just the parts that contain user-specified
data. If they encrypt things like the file headers that contain more
or less known values, this can be used to detect when you have a
correct decryption. Though it might seem obvious that you wouldn't
want to encrypt such things, many programs have done so -- just for
example, WordPerfect used to encrypt the file header along with the
actual data in the file, making decryption extremely easy (of course,
the fact that they used an algorithm that made even RC4-32 look strong
by comparison helped too...)
--
Later,
Jerry.
The universe is a figment of its own imagination.
------------------------------
From: [EMAIL PROTECTED] (Jerry Coffin)
Subject: Re: Patent Free Public Key Encryption
Date: Wed, 13 Oct 1999 22:09:31 -0600
In article <7u2upa$29i$[EMAIL PROTECTED]>, [EMAIL PROTECTED] says...
> I have been looking for a Petent Free Public Key implementation.
Probably the most obvious method right now would be Diffie-Hellman.
Technically speaking, there IS a patent on it, but the patent's
expired, so the algorithm is now in the public domain.
--
Later,
Jerry.
The universe is a figment of its own imagination.
------------------------------
From: [EMAIL PROTECTED] (CryptoBook)
Subject: Re: Crypto 1981-1997 CD-ROM fix
Date: 14 Oct 1999 04:18:49 GMT
In article <[EMAIL PROTECTED]>, Medical Electronics Lab
<[EMAIL PROTECTED]> writes:
...
>> Springer-Verlag has now released the CD-ROM with the entire proceedings
>> of the Crypto and Eurocrypt conferences from 1981-1997. These were for
>> sale at Crypto 99 this week.
>
>How much? Can I order from Springer New York? What's the ISBN?
...
They are in stock at CCB at a favorable price:
ADVANCES IN CRYPTOLOGY 1981-- 1997: Electronic Proceedings and Index of the
CRYPTO and EUROCRYPT Conferences 1981 -- 1997
Kevin S. McCurley and Claus Dieter Ziegler (Editors)
"This book and CD-ROM presents the complete collection of all proceedings of
the 32 CRYPTO and EUROCRYPT conferences held between 1981 and 1997. Besides
[14,692] digitized pages of text in [Adobe Acrobat] PDF format, the CD-ROM
provides a user-friendly interface for navigation, search tools, and indexes.
The book gives a complete documentation of the conferences covered from the
meta-cryptology point of view; it also provides a printed index listing all
contributing authors and their papers . The CD-ROM is ready for use on most
common platforms." -- from the rear cover. The preface describes the
interesting and, at times, formidable problems encountered in creating a
searchable index from OCR data (obtained from high-resolution TIF images) and
how those problems were overcome.
Springer, 1999, xx + 460 pp, CD-ROM
Softbound: Pub. $99.00, Member $74.95, Nonmember $79.95
Member prices are available to members of the American Cryptogram Association,
the US Naval Cryptologic Veterans Association, and full time students. Shipping
and handling are extra. For complete ordering information, a free catalog of
crypto books, or for information about membership in the American Cryptogram
Association, please send email to [EMAIL PROTECTED]
Best Wishes,
Gary
Gary Rasmussen
Classical Crypto Books
E-Mail: [EMAIL PROTECTED]
Fax: (603) 432-4898
------------------------------
From: [EMAIL PROTECTED] (Paul Rubin)
Subject: Re: A viable security strategy (and looking for off-the-shelf product)
Date: 14 Oct 1999 04:17:51 GMT
In article <7u2nbo$7i3$[EMAIL PROTECTED]>, <[EMAIL PROTECTED]> wrote:
>I'm working on a system where we need to be able to hand off control
>from one web site to another securely. So the plan is to have the
>hand-off procedure on site A contact site B to retrieve the appropriate
>session variables for hand-off. However, to guard against IP spoofing
>attacks, what I'd like to do is have site B return some piece of text
>which needs to be returned to it by site A using some encryption method.
>The theory being that in this way we can be relatively sure that we're
>getting a valid login request.
If you explain in more detail what you're trying to do, you might
get better answers. From what you've described, I'd say just run
SSL on both sites A and B, and hand the user off by sending a 302
redirect. If A and B are in the same domain you can pass the session
variables in a cookie. Otherwise, encode them in the URL path.
They will still be encrypted by SSL. The site certificates at A and B
will protect from spoofing. The user will be able to see and modify
the session variables--is that a problem? If so, you could always
encrypt them.
------------------------------
** FOR YOUR REFERENCE **
The service address, to which questions about the list itself and requests
to be added to or deleted from it should be directed, is:
Internet: [EMAIL PROTECTED]
You can send mail to the entire list (and sci.crypt) via:
Internet: [EMAIL PROTECTED]
End of Cryptography-Digest Digest
******************************
