Re: Second thoughts on owner-id mechanism

2002-02-28 Thread Bill Janssen
> > > What I looked for was a way to protect the document, assuming only minor > > changes to the viewer or the document itself by an attacker. > > Given the recent "awareness" of security issues lately, driven > mostly by the media, let's choose terms a bit differently here. How about > "

Re: Second thoughts on owner-id mechanism

2002-02-28 Thread David A. Desrosiers
> What I looked for was a way to protect the document, assuming only minor > changes to the viewer or the document itself by an attacker. Given the recent "awareness" of security issues lately, driven mostly by the media, let's choose terms a bit differently here. How about "obscure" the

Re: Second thoughts on owner-id mechanism

2002-02-28 Thread Bill Janssen
Terence, I've been through this with a number of security researchers. There is no way short of a full public key system (and probably not even then) to more strongly protect a document that's in a documented format displayed via open-source software. What I looked for was a way to protect the

Re: Second thoughts on owner-id mechanism

2002-02-28 Thread Bill Janssen
Mike, please send me a copy of your urllib.py file, would you? Thanks. It should be at /usr/lib/python*/urllib.py. Bill

Re: Second thoughts on owner-id mechanism

2002-02-28 Thread Terence Tan
On Friday, March 1, 2002, at 08:02 , Bill Janssen wrote: > The current setup XOR's the owner-id with the beginning of each > zlib-compressed segment. This makes it (cryptographically) fairly > easy to get the owner-id out of the document. A better scheme would > be to construct a sequence of ha

Re: Second thoughts on owner-id mechanism

2002-02-28 Thread Michael Nordström
On Thu, Feb 28, 2002, Bill Janssen wrote: > I've come up with a better way of encrypting the owner-id information, > so I'd like to hold up any release till I put it in. Go ahead. As long as the included RH fix breaks the parser on my non-RH system I can't honestly consider the current version re

Second thoughts on owner-id mechanism

2002-02-28 Thread Bill Janssen
I've come up with a better way of encrypting the owner-id information, so I'd like to hold up any release till I put it in. I'll try to do it tomorrow. The current setup XOR's the owner-id with the beginning of each zlib-compressed segment. This makes it (cryptographically) fairly easy to get t