Re: [cryptography] can the German government read PGP and ssh traffic?

2012-06-10 Thread ianG
On 5/06/12 23:46 PM, Thierry Moreau wrote: Hi Peter, Replying on the thinking process, not on the fundamentals at this time (we seem to agree on the characteristics of PKC vs else). Peter Gutmann wrote: Thierry Moreau writes: Unless automated SSH sessions are needed (which is a different pr

Re: [cryptography] Microsoft Sub-CA used in malware signing

2012-06-10 Thread Nico Williams
On Sun, Jun 10, 2012 at 3:03 PM, Florian Weimer wrote: > * Marsh Ray: > >> Marc Stevens and B.M.M. de Weger (of >> http://www.win.tue.nl/hashclash/rogue-ca/) have been looking at the >> collision in the evil CN=MS cert. I'm sure they'll have a full report >> at some point. Until then, they have sa

Re: [cryptography] Microsoft Sub-CA used in malware signing

2012-06-10 Thread Marsh Ray
On 06/10/2012 03:03 PM, Florian Weimer wrote: Does this mean they've seen the original certificate in addition to the evil twin? Until then, there is another explanation besides an advance in cryptanalysis. Just saying. 8-) I guess I look at it like this: Start with the simplest explanation

Re: [cryptography] Microsoft Sub-CA used in malware signing

2012-06-10 Thread Weger, B.M.M. de
Hi Florian, > * Marsh Ray: > > > Marc Stevens and B.M.M. de Weger (of > > http://www.win.tue.nl/hashclash/rogue-ca/) have been looking at the > > collision in the evil CN=MS cert. I'm sure they'll have a full report > > at some point. Until then, they have said this: > > >> [We] have confirmed t

Re: [cryptography] Microsoft Sub-CA used in malware signing

2012-06-10 Thread Florian Weimer
* Marsh Ray: > Marc Stevens and B.M.M. de Weger (of > http://www.win.tue.nl/hashclash/rogue-ca/) have been looking at the > collision in the evil CN=MS cert. I'm sure they'll have a full report > at some point. Until then, they have said this: >> [We] have confirmed that flame uses a yet unknown

Re: [cryptography] can the German government read PGP and ssh traffic?

2012-06-10 Thread Peter Gutmann
Thierry Moreau writes: >Would you extend the association to PGP usage? Magical thinking works independently of technology, so I'm sure there's a lot of it in the PGP world as well :-). >Would you extend the association to Lotus Notes as another PKC user community >(http://en.wikipedia.org/wiki