RE: Lions and Tigers and Backdoors, oh, my...

2000-09-29 Thread Trei, Peter
> -- > From: Michael Motyka[SMTP:[EMAIL PROTECTED]] > Using an embedded system is not a new topic here. I think its the only > viable method of securing data. > > On that note, given the little wireless gizmo of Tim's description, the > device could have, via appropriate applica

Re: Lions and Tigers and Backdoors, oh, my...

2000-09-28 Thread Tim May
At 3:03 PM -0400 9/28/00, David Honig wrote: > >One very common security model is that the security perimeter includes >the PC and you're only concerned with transmission interception. > >MS is swiss cheese but most OS have some weakness in many configs. > >How many people actually look at the so

Re: Lions and Tigers and Backdoors, oh, my...

2000-09-28 Thread David Honig
At 01:51 PM 9/28/00 -0400, Michael Motyka wrote: >You're running these crypto modules on an MS OS? Plaintext is entered >via the PC HW/MS Drivers and then exists in memory on the MS system? >This probably describes the environment for most users, though not >necessarily most of those on this list

Re: Lions and Tigers and Backdoors, oh, my...

2000-09-28 Thread Michael Motyka
> On Wed, 27 Sep 2000, David Honig wrote: > > >Modularity *is* useful for keeping things simple enough to analyze, but > >isn't a library with a well-defined API sufficient? > > This sort of highlights how the current models of shared code fail. A good > deal of modularity and independence of cr

Re: Lions and Tigers and Backdoors, oh, my...

2000-09-28 Thread Sampo A Syreeni
On Wed, 27 Sep 2000, David Honig wrote: >Modularity *is* useful for keeping things simple enough to analyze, but >isn't a library with a well-defined API sufficient? This sort of highlights how the current models of shared code fail. A good deal of modularity and independence of cryptography imp

Re: Lions and Tigers and Backdoors, oh, my...

2000-09-27 Thread Tim May
At 10:41 PM -0400 9/27/00, David Honig wrote: >At 07:51 PM 9/27/00 -0400, Tim May wrote: >>At 7:33 PM -0400 9/27/00, David Honig wrote: >>> >>> >>>It does create a single-point-of-failure if everyone uses the same >>>library (or other independent 'module'), but on the other hand, everyone >>>rolli

Re: Lions and Tigers and Backdoors, oh, my...

2000-09-27 Thread David Honig
At 07:51 PM 9/27/00 -0400, Tim May wrote: >At 7:33 PM -0400 9/27/00, David Honig wrote: >> >> >>It does create a single-point-of-failure if everyone uses the same >>library (or other independent 'module'), but on the other hand, everyone >>rolling their own is likely to introduce more fatal flaws.

Re: Lions and Tigers and Backdoors, oh, my...

2000-09-27 Thread brflgnk
Tim said: -- begin quote -- I can't speak to the truth or falsity or plausibility of some of the claims here, but there is a general point: modularization. There is no real reason for crypto to be built into complex products, at least not when those products are well-suited for handling text (a

Re: Lions and Tigers and Backdoors, oh, my...

2000-09-27 Thread Tim May
At 7:33 PM -0400 9/27/00, David Honig wrote: > > >It does create a single-point-of-failure if everyone uses the same >library (or other independent 'module'), but on the other hand, everyone >rolling their own is likely to introduce more fatal flaws. > >Curious what the alternatives are, I said n

Re: Lions and Tigers and Backdoors, oh, my...

2000-09-27 Thread David Honig
At 06:48 PM 9/27/00 -0400, Tim May wrote: > >There is no real reason for crypto to be built into complex products, >at least not when those products are well-suited for handling text >(and even files). ... >To wit, who really cares whether Netscape 4.08 or 4.07 has crypto >built in so long as a

Re: Lions and Tigers and Backdoors, oh, my...

2000-09-27 Thread Tim May
At 6:24 PM -0400 9/27/00, [EMAIL PROTECTED] wrote: >Ray said: >-- begin quote -- >I do not buy the story that what happened to PGP >was an accident; on the contrary, it was just NAI doing what they >had to do to get approval to put it up for international downloads, >the same as Lotus just did wha

Re: Lions and Tigers and Backdoors, oh, my...

2000-09-27 Thread brflgnk
Ray said: -- begin quote -- I do not buy the story that what happened to PGP was an accident; on the contrary, it was just NAI doing what they had to do to get approval to put it up for international downloads, the same as Lotus just did what it had to do. -- end quote -- I have to agree. The

Re: Lions and Tigers and Backdoors, oh, my...

2000-09-27 Thread Matt Curtin
> "Steve" == Steve Furlong <[EMAIL PROTECTED]> writes: Steve> The only thing that might be the "help" field is "X-UIDL", Steve> which has a value of random-seeming characters. UIDL is Unique ID Listing, described in section 7 of RFC 1725, "Post Office Protocol - Version 3". Steve> I,

Re: Lions and Tigers and Backdoors, oh, my...

2000-09-27 Thread Steve Furlong
"Trei, Peter" wrote: > > Can you document this claim of the existance of 'help fields' in > Netscape? I am (to put it mildly) astonished by this claim, and > more than a little skeptical. I was aware of the Workfactor > Reduction field in the export 'aka International' version of Lotus Notes > (w