Re: [cryptography] SSL session resumption defective (Re: What project would you finance? [WAS: Potential funding for crypto-related projects])

2013-07-05 Thread Trevor Perrin
On Thu, Jul 4, 2013 at 11:33 AM, Adam Back wrote: > > Not completely by this counterexample: generate k, suffer from an enemy >> copy of system state including k, let k'=H(k), delete k', use k' in >> dangerous confidence. I mean the textbook PFS definition is not satisfied >> by k'=H(k). >> > > I

Re: [cryptography] DeCryptocat

2013-07-05 Thread Nadim Kobeissi
On 2013-07-05, at 6:14 PM, Douglas Huff wrote: > > On Jul 4, 2013, at 22:09, Jacob Appelbaum wrote: > >> Nadim Kobeissi: >>> ... >>> AES-GCM is already prioritized over RC4, but unfortunately most >>> browsers don't support AES-GCM yet, which is why RC4 remains as the >>> secondary choice. In

Re: [cryptography] DeCryptocat

2013-07-05 Thread Nadim Kobeissi
On 2013-07-05, at 7:09 AM, Jacob Appelbaum wrote: > Nadim Kobeissi: >> >> On 2013-07-05, at 6:15 AM, Matthew Green >> wrote: >> >>> >>> >>> On Jul 5, 2013, at 12:01 AM, Jacob Appelbaum >>> wrote: >>> Nadim Kobeissi: > > On 2013-07-05, at 3:15 AM, Jacob Appelbaum > wrote

Re: [cryptography] DeCryptocat

2013-07-05 Thread Jacob Appelbaum
Nadim Kobeissi: > Sorry, I wasn't meaning to avoid any questions. I simply forgot to > answer them. It's best to assume good will from others on a > discussion list. Glad to hear it. > > I do not know how many users choose forward secret protocols, nor do > I imagine there is a standardized or e

Re: [cryptography] DeCryptocat

2013-07-05 Thread Fabio Pietrosanti (naif)
Il 7/5/13 8:34 PM, Jacob Appelbaum ha scritto: "Module ngx_http_ssl_module supports the following built-in variables: "$ssl_cipher returns the cipher suite being used for the currently established SSL/TLS connection "$ssl_protocol returns the protocol of the currently established SSL/TLS connec