Re: [cryptography] US Appeals Court upholds right not to decrypt a drive

2012-02-26 Thread ianG
On 25/02/12 18:50 PM, Jon Callas wrote: "...We're not *stupid*." Once upon a time ...ok skip the annoying anecdote and get to the question: What would be the smallest steganography program that someone could type in and use to hide ones secret archive in plain site? iang ...a long long

Re: [cryptography] (off-topic) Bitcoin is a repeated lesson in cryptography applications - was "endgame"

2012-02-26 Thread dan
Well put, James. Warren Buffet's arguments are, to my eye, aligned with yours. He argues that gold has no intrinsic value, unlike farmland or a company like Coca Cola. In that way, his evaluation is as instrumentalist as is yours, to the extent that I understand the both of you. His discussion

[cryptography] Diginotar summary

2012-02-26 Thread Peter Gutmann
The following is an attempt to gather all the information on the Diginotar meltdown in one place. There's references to external sources ("[REF...]") and cross-links ("!!") which aren't present in the text, but apart from that it should be pretty complete. I've posted it here in case anyone f

Re: [cryptography] (off-topic) Bitcoin is a repeated lesson in cryptography applications - was "endgame"

2012-02-26 Thread Benjamin Kreuter
On Sun, 26 Feb 2012 08:48:05 -0500 d...@geer.org wrote: > > Well put, James. Warren Buffet's arguments are, to my eye, > aligned with yours. He argues that gold has no intrinsic > value, unlike farmland or a company like Coca Cola. In that > way, his evaluation is as instrumentalist as is your

Re: [cryptography] (off-topic) Bitcoin is a repeated lesson in cryptography applications - was "endgame"

2012-02-26 Thread Benjamin Kreuter
On Sun, 26 Feb 2012 17:57:14 +1000 "James A. Donald" wrote: > > On 2012-02-26 1:18 AM, Benjamin Kreuter wrote: The demand > > for Bitcoin as a currency is driven by its properties as a > > digital cash system; people still need to get their > > nation's currency at some point > > Frau Eisenm

Re: [cryptography] trustwave admits issuing corporate mitm certs

2012-02-26 Thread Andy Steingruebl
On Sat, Feb 25, 2012 at 4:54 PM, Marsh Ray wrote: > > Still it might be worth pointing that if Wells Fargo really wanted to > forbid a Trustwave network-level MitM, SSL/TLS provides the capability to > enforce that policy at the protocol level. They could configure their web > app to require a cl

Re: [cryptography] (off-topic) Bitcoin is a repeated lesson in cryptography applications - was "endgame"

2012-02-26 Thread Bill St. Clair
On Sun, Feb 26, 2012 at 10:08 AM, Benjamin Kreuter wrote: > On Sun, 26 Feb 2012 08:48:05 -0500 > d...@geer.org wrote: > Money and government go hand in hand.  Governments need money in order > to manage taxes, fees, fines, and so forth; yet money becomes valuable > because of the legal structure

Re: [cryptography] (off-topic) Bitcoin is a repeated lesson in cryptography applications - was "endgame"

2012-02-26 Thread Benjamin Kreuter
On Sun, 26 Feb 2012 11:00:15 -0500 "Bill St. Clair" wrote: > On Sun, Feb 26, 2012 at 10:08 AM, Benjamin Kreuter > wrote: > > On Sun, 26 Feb 2012 08:48:05 -0500 > > d...@geer.org wrote: > > > Money and government go hand in hand.  Governments need money in > > order to manage taxes, fees, fines,

Re: [cryptography] (off-topic) Bitcoin is a repeated lesson in cryptography applications - was "endgame"

2012-02-26 Thread Bill St. Clair
On Sun, Feb 26, 2012 at 11:40 AM, Benjamin Kreuter wrote: > On Sun, 26 Feb 2012 11:00:15 -0500 > "Bill St. Clair" wrote: > >> On Sun, Feb 26, 2012 at 10:08 AM, Benjamin Kreuter > I do not follow your argument -- how does eliminating government issued > money stop governments from collecting taxe

Re: [cryptography] Explaining crypto to engineers

2012-02-26 Thread Ondrej Mikle
On 02/26/2012 04:47 AM, Kevin W. Wall wrote: > On Sat, Feb 25, 2012 at 2:22 PM, Ondrej Mikle wrote: > >> Estimating RSA key size: it's more an educated guess/magic given how the >> sizes >> are derived than anything else. And if you base your estimate for given time >> window on Lenstra or ECRYP

Re: [cryptography] US Appeals Court upholds right not to decrypt a drive

2012-02-26 Thread Jon Callas
On Feb 25, 2012, at 3:18 PM, Kevin W. Wall wrote: > On Sat, Feb 25, 2012 at 2:50 AM, Jon Callas wrote: > > [snip] > >> But to get to the specifics here, I've spoken to law enforcement and >> border control people in a country that is not the US, who told me >> that yeah, they know all about Tr

Re: [cryptography] US Appeals Court upholds right not to decrypt a drive

2012-02-26 Thread Harald Hanche-Olsen
[Jon Callas (2012-02-26 17:35:55 UTC)] > On Feb 25, 2012, at 3:18 PM, Kevin W. Wall wrote: > > But I'd be SOL when then went looking for a second > > hidden volume simply because one doesn't exist. Guess if I ever go out of > > the country with my laptop, I'd just better securely wipe that partio

Re: [cryptography] (off-topic) Bitcoin is a repeated lesson in cryptography applications - was "endgame"

2012-02-26 Thread Jeffrey Walton
On Sun, Feb 26, 2012 at 10:08 AM, Benjamin Kreuter wrote: > On Sun, 26 Feb 2012 08:48:05 -0500 > d...@geer.org wrote: > >> >> Well put, James.  Warren Buffet's arguments are, to my eye, >> aligned with yours.  He argues that gold has no intrinsic >> value, unlike farmland or a company like Coca Co

Re: [cryptography] US Appeals Court upholds right not to decrypt a drive

2012-02-26 Thread Marsh Ray
On 02/26/2012 11:35 AM, Jon Callas wrote: On Feb 25, 2012, at 3:18 PM, Kevin W. Wall wrote: On Sat, Feb 25, 2012 at 2:50 AM, Jon Callas wrote: I asked them about the case where someone has TrueCrypt but doesn't have a hidden volume, what would happen to someone doesn't have one? Their respons

Re: [cryptography] Explaining crypto to engineers (was: Duplicate primes in lots of RSA moduli)

2012-02-26 Thread Jeffrey Walton
On Sun, Feb 26, 2012 at 1:46 AM, Jeffrey Walton wrote: > On Sat, Feb 25, 2012 at 10:47 PM, Kevin W. Wall > wrote: >> >> [SNIP] >> >> Thanks for the link. It took me a LONG time to convince the ESAPI team >> of this because I was the newb to them and I came in and said we >> need to at least need

Re: [cryptography] Explaining crypto to engineers

2012-02-26 Thread Ondrej Mikle
On 02/26/2012 04:47 AM, Kevin W. Wall wrote: > On Sat, Feb 25, 2012 at 2:22 PM, Ondrej Mikle wrote: > >>> 5) They don't know what padding is, or when/why to use it. >> >> I vaguely remember some past attacks on (I think) PKCS#1 padding, it was long >> time ago (I'm guessing it's fixed in PKCS#1-1

Re: [cryptography] US Appeals Court upholds right not to decrypt a drive

2012-02-26 Thread Jon Callas
On Feb 25, 2012, at 6:35 PM, James A. Donald wrote: > Jon Callas writes: > > > I've spoken to law enforcement and border control people > > > in a country that is not the US, who told me that yeah, > > > they know all about TrueCrypt and their assumption is that > > > *everyone* who has TrueCryp

Re: [cryptography] trustwave admits issuing corporate mitm certs

2012-02-26 Thread Marsh Ray
On 02/26/2012 09:34 AM, Andy Steingruebl wrote: On Sat, Feb 25, 2012 at 4:54 PM, Marsh Ray mailto:ma...@extendedsubset.com>> wrote: Still it might be worth pointing that if Wells Fargo really wanted to forbid a Trustwave network-level MitM, SSL/TLS provides the capability to enforce that policy

Re: [cryptography] (off-topic) Bitcoin is a repeated lesson in cryptography applications - was "endgame"

2012-02-26 Thread ianG
On 27/02/12 03:00 AM, Bill St. Clair wrote: You've just made a very good argument for eliminating money, at least government issued money. Yes, governments just love to assess taxes, fees, and fines. No, I have no need of any of that. Maybe, maybe not. The princes, bandits argument is not on

Re: [cryptography] Explaining crypto to engineers

2012-02-26 Thread ianG
On 26/02/12 14:47 PM, Kevin W. Wall wrote: But if I could put to something that was about 5-8 pages about something like "Ten Things Every Developer Should Know About Cryptography", that would be great for starters. Does such a thing exist? Maybe it can't distilled to only 10, but you get my poi

Re: [cryptography] (off-topic) Bitcoin is a repeated lesson in cryptography applications - was "endgame"

2012-02-26 Thread James A. Donald
d...@geer.org wrote: > Warren Buffet's arguments are, to my eye, aligned with > yours. He argues that gold has no intrinsic value, unlike > farmland or a company like Coca Cola. In that way, his > evaluation is as instrumentalist as is yours, to the extent > that I understand the both of you. H

Re: [cryptography] (off-topic) Bitcoin is a repeated lesson in cryptography applications - was "endgame"

2012-02-26 Thread James A. Donald
See 2011 shareholder letter www.berkshirehathaway.com/letters/2011ltr.pdf Warren Buffet's argument leads to the conclusion that had Roman in the time of Caesar invested a talent in land, or deposited some money with the money lenders to earn interest, his descendents would now be worth 10^67

Re: [cryptography] (off-topic) Bitcoin is a repeated lesson in cryptography applications - was "endgame"

2012-02-26 Thread James A. Donald
On 2012-02-27 1:28 AM, Benjamin Kreuter wrote: If the US Dollar were to fail, Bitcoin would be the last thing on anyone's mind; we would probably wind up switching to some other government's currency while we sorted out the mess (Yuan perhaps), or we would just spend our time killing each other a

Re: [cryptography] (off-topic) Bitcoin is a repeated lesson in cryptography applications - was "endgame"

2012-02-26 Thread James A. Donald
On 2012-02-27 1:28 AM, Benjamin Kreuter wrote: > If the US Dollar were to fail, Bitcoin would be the last > thing on anyone's mind; we would probably wind up switching > to some other government's currency while we sorted out the > mess (Yuan perhaps), or we would just spend our time > killing eac

Re: [cryptography] US Appeals Court upholds right not to decrypt a drive

2012-02-26 Thread James A. Donald
On 2012-02-27 3:35 AM, Jon Callas wrote: > Remember what I said -- they're law enforcement and border > control. In their world, Truecrypt is the same thing as a > suitcase with a hidden compartment. When someone crosses a > border (or they get to perform a search), hidden > compartments aren't ex

Re: [cryptography] US Appeals Court upholds right not to decrypt a drive

2012-02-26 Thread James A. Donald
On 2012-02-27 4:29 AM, Harald Hanche-Olsen wrote: I know nothing about TrueCrypt, but I imagine a technical solution to this kind of problem exists: Just give TrueCrypt the ability to have a virtually unlimited number of hidden volumes. Now you can reveal them, one after the other, in increasing

Re: [cryptography] US Appeals Court upholds right not to decrypt a drive

2012-02-26 Thread James A. Donald
On 2012-02-27 5:09 AM, Marsh Ray wrote: So everyone who now has a hidden 2nd Truecrypt partition with incriminating things in it needs to make it their hidden 3rd partition and in the hidden 2nd partition instead store things which are merely embarrassing. Except that as it is stipulated that th

Re: [cryptography] US Appeals Court upholds right not to decrypt a drive

2012-02-26 Thread Kevin W. Wall
On Sun, Feb 26, 2012 at 8:36 PM, James A. Donald wrote: > On 2012-02-27 3:35 AM, Jon Callas wrote: >> Remember what I said -- they're law enforcement and border >> control. In their world, Truecrypt is the same thing as a >> suitcase with a hidden compartment. When someone crosses a >> border (or

Re: [cryptography] (off-topic) Bitcoin is a repeated lesson in cryptography applications - was "endgame"

2012-02-26 Thread Randall Webmail
From: "James A. Donald" >Warren Buffet correctly argues that gold will, on average, >lose value. However there is a significant risk that >everything except gold will lose value. There is no risk that potable water or salt or (properly maintained) rifles with ammunition will lose value. Gold

Re: [cryptography] US Appeals Court upholds right not to decrypt a drive

2012-02-26 Thread Peter Gutmann
Marsh Ray writes: >Except that as it is stipulated that the captors are "not stupid", we must >assume they are perfectly rational actors who will have worked out this >strategy too. It's not an exercise in game theory, it's standard police work. If they've watched you downloading child porn f

Re: [cryptography] (off-topic) Bitcoin is a repeated lesson in cryptography applications - was "endgame"

2012-02-26 Thread Jonathan Thornburg
Someone whose name has overflowed my nested-quoting stack wrote > Perhaps you just need a short list of reasons why Bitcoin > is not going to replace government issued currencies: > > 1. No offline transactions, which makes Bitcoin useless for > a large class of transactions. On Mon, 27 Feb 2012,

Re: [cryptography] Explaining crypto to engineers

2012-02-26 Thread Peter Gutmann
Ondrej Mikle writes: >I've just found an article about the OAEP padding oracle (that I couldn't >recall before): There's another one that was published about a year ago that looks at things like side-channel attacks via the integer-to-octet-string conversion primitives and other really low-ba

Re: [cryptography] US Appeals Court upholds right not to decrypt a drive

2012-02-26 Thread Marsh Ray
On 02/26/2012 09:08 PM, Peter Gutmann wrote: Marsh Ray writes: Except that as it is stipulated that the captors are "not stupid", we must assume they are perfectly rational actors who will have worked out this strategy too. It's not an exercise in game theory, it's standard police work. My

Re: [cryptography] US Appeals Court upholds right not to decrypt a drive

2012-02-26 Thread Peter Gutmann
"James A. Donald" writes: >Hidden compartment? What hidden compartment? If I have one, you are welcome >to search it. Go knock yourselves out. James, meet Bertha. Sorry about her cold hands, just give her a minute to get the gloves on. In the meantime if you'll drop your trousers... Peter.