Another entry in the internet security hall of shame....

2005-08-23 Thread John Kelsey
Guys, Recently, Earthlink's webmail server certificate started showing up as expired. (It obviously expired a long time ago; I suspect someone must have screwed up in changing keys over or something, because the problem wasn't happening up until recently.) So, I contacted Earthlink's technica

[Clips] RSA Security Sees Hope in Online Fraud

2005-08-23 Thread R.A. Hettinga
--- begin forwarded text Delivered-To: [EMAIL PROTECTED] Date: Tue, 23 Aug 2005 09:01:29 -0400 To: Philodox Clips List <[EMAIL PROTECTED]> From: "R.A. Hettinga" <[EMAIL PROTECTED]> Subject: [Clips] RSA Security Sees Hope in Online Fraud Reply-To: [EMAIL PROTECTED] Sender: [EMAIL PROTECTED

Re: Fwd: Tor security advisory: DH handshake flaw

2005-08-23 Thread Ben Laurie
Jerrold Leichter wrote: | > Isn't *proving* primality rather overkill for the purpose at hand (which | > seems to be verifying that an alleged prime isn't a non-prime, sent to | > "spike" the system). Are there any known sets of numbers - much less ways | > to *choose* members of those sets - wh

Re: Fwd: Tor security advisory: DH handshake flaw

2005-08-23 Thread Ben Laurie
Tero Kivinen wrote: Hal Finney writes: Several programs to implement ECPP can be found from http://primes.utm.edu/links/programs/seeking_large_primes/. I don't know about source code however. It might be interesting to run these over some of the Oakley primes and publish the certs - I vaguely

The Devil's Infosec Dictionary

2005-08-23 Thread Udhay Shankar N
Largely true, sometimes funny. http://www.csoonline.com/read/080105/debrief.html Samples: 24/7 adj. The window of time in which systems are most vulnerable to attack -- Biometrics Strong authentication mechanism that streamlines insider attacks -- Cryptography The science of applying a c