Re: [cryptography] Practical Threshold Signatures

2013-11-13 Thread James A. Donald
On 2013-11-13 16:14, realcr wrote: 2. Can I actually trust the elliptic curve with weil pairing to do its cryptographic job? Maybe better asked: Can I trust it like I trust that it is hard to factor numbers? (Maybe even more?) The Weil pairing is a great big hole in our usual arguments that mos

Re: [cryptography] Practical Threshold Signatures

2013-11-13 Thread James A. Donald
On 2013-11-13 16:14, realcr wrote: From what I understand, the group I'm looking for is an elliptic cure with a weil pairing. (Jonathan mentioned bilinear map, I assume that means the same thing?) A pairing is a bilinear map. The Weil pairing is a particular bilinear map on the points of cer

Re: [cryptography] NIST Randomness Beacon (andrew cooke) (and Andy Isaacson, et al.)

2013-11-13 Thread Joshua Kingsolver Price
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Something of a noob question, but what about random.org? Is there some reason why this site isn't used by the cryptographically wise? It seems that they already offer public entropy, and from a very good source. Sure you still can't use it for keys, bu

Re: [cryptography] NIST Randomness Beacon (andrew cooke) (and Andy Isaacson, et al.)

2013-11-13 Thread Natanael
Because there's no guarantees at all for anything at all for that site. On Wed, Nov 13, 2013 at 6:10 PM, Joshua Kingsolver Price wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA1 > > Something of a noob question, but what about random.org? Is there some > reason why this site isn't used by

[cryptography] Fwd: Moving forward on improving HTTP's security

2013-11-13 Thread Greg
If you haven't heard, the IETF is trying to move forward with "HTTP 2.0", which is, from what I can tell, simply "HTTPS all the time". We know HTTPS is broken and that it gives people a false sense of security, leading them to share material that they otherwise might not share, with potentially

Re: [cryptography] Fwd: Moving forward on improving HTTP's security

2013-11-13 Thread Greg
Some sanity appears: On Nov 13, 2013, at 1:57 PM, Mike Bishop wrote: > While the language may be strong, I agree with the sentiment that they are > distinct mechanisms. Mark has proposed a mechanism, independent of HTTP/2.0, > which can be used to migrate from an HTTP connection to an HTTPS c

Re: [cryptography] Fwd: Moving forward on improving HTTP's security

2013-11-13 Thread Paul Hoffman
On Nov 13, 2013, at 10:40 AM, Greg wrote: > If you haven't heard, the IETF is trying to move forward with "HTTP 2.0", > which is, from what I can tell, simply "HTTPS all the time". The latter is a mis-characterization. If you read the WG's mailing list, you will see that there are a variety of

[cryptography] Fwd: [Cfrg] Fwd: New Non-WG Mailing List: dsfjdssdfsd

2013-11-13 Thread Sandy Harris
-- Forwarded message -- From: Stephen Farrell Date: Wed, Nov 13, 2013 at 5:05 PM Subject: [Cfrg] Fwd: New Non-WG Mailing List: dsfjdssdfsd To: "\"s...@ietf.org\" per" , perpass , "c...@irtf.org" , "sec...@ietf.org" Cc: Apps Discuss Hi, There was some discussion in Vancouver a

[cryptography] Password Blacklist that includes Adobe's Motherload?

2013-11-13 Thread Jeffrey Walton
Hi All, Is anyone aware of a blacklist that includes those 150 million records from Adobe's latest breach? I tried finding a list and was not successful. Bonus points if implemented as a bloom filter (I'm interested in seeing how small that list can be in practice, and I'd like to use it for its

Re: [cryptography] Password Blacklist that includes Adobe's Motherload?

2013-11-13 Thread shawn wilson
On Wed, Nov 13, 2013 at 9:13 PM, Jeffrey Walton wrote: > Hi All, > > Is anyone aware of a blacklist that includes those 150 million records > from Adobe's latest breach? > This is the only thing I've seen (haven't really looked): http://stricture-group.com/files/adobe-top100.txt > I tried findin

Re: [cryptography] Password Blacklist that includes Adobe's Motherload?

2013-11-13 Thread nickg
Take a look at http://dazzlepod.com/uniqpass/ Previously, I’m just kept that file as is, and did a case-insentive binary search directly on disk… took maybe 10 seeks ~ 1ms to see if something was present or not and could be done via command line. No index required, no loading required. I’m

Re: [cryptography] Password Blacklist that includes Adobe's Motherload?

2013-11-13 Thread dan
> Is anyone aware of a blacklist that includes those 150 million records > from Adobe's latest breach? > > I tried finding a list and was not successful. Bonus points if > implemented as a bloom filter (I'm interested in seeing how small that > list can be in practice, and I'd like to use it for