Cryptography October 2006

cryptography@lists.squeakfoundation.org

13 participants
38 discussions

Notification of publicly available cryptography code
by Ron Teitelbaum 28 Nov '06

28 Nov '06

Notification of publicly available cryptography code: Cryptography code and access to a repository for continuing development will be made publicly available on or after Monday Jan 9th 2006 as part of the Open Source Squeak Project (www.squeak.org <http://www.squeak.org/> ). The code can be accessed two ways. Either through www.squeakSource.com <http://www.squeaksource.com/> in the cryptography project or through the squeak software itself. The location for the Squeak Montecello repository using HTTP accessed through the Squeak software is: MCHttpRepository location: 'http://kilana.unibe.ch:8888/Cryptography' user: '' password: '' Thank you, Ron Teitelbaum Squeak Cryptography Team Leader

3 5

Re: Fortuna
by Chris Muller 25 Oct '06

25 Oct '06

Hi! I'm doing very well. Fortuna is actually not part of KryptOn, it's its own package (one class, 9 methods) which KryptOn loads as a prereq in advance of itself. This way Fortuna can be used on its own as just another RandomGenerator subclass, without KryptOn. KryptOn does not, itself, implement any security primitives, only uses the ones from our Crypto library. To implement Fortuna, I factored SecureRandom into a superclass, RandomGenerator, RandomGenerator SecureRandom Fortuna so that code wouldn't be duplicated. RandomGenerator has but five methods: nextBits: bitLength "answer a random integer up to size bitLength" subclassResponsibility nextBytes: anInteger "Generate and answer a ByteArray of size anInteger filled with random data." subclassResponsibility nextFrom: start to: end "Answer a random integer between start and end." nextInt: anInteger "Answer a random integer in the interval [1, anInteger]." destroy "destroy seed keys, etc." subclassResponsibility and Fortuna and, now, SecureRandom, override the proper methods accordingly. Though Fortuna is "done" I never did post it to the Crypto library yet because I got side-tracked earlier this year to do the (significant) query's function for Magma. Also, I didn't think there would be much interest in it. If there is, I'll see about packaging it up and posting it. I do plan to return and finish KryptOn. It's been long enough that I feel I'll have to read through the whole book again and scruntinize my code closely (this will be the "third" time doing so!). This is always good though, to review with a fresh, suspicious perspective again. The goal is to allow Magma to run naked on the Net without being hacked, supporting two-tier Squeak applications. > Even knowing how it all works, I would think it would be very difficult for me to break the code, unless I was able to introduce new code into the running system. So if we can solve the problem of introducing new code, and we could add Fortuna and some of the requirements Practical Cryptography for protecting secrets I would think we are a long way towards > making a very secure channel implementation for a client system. Yeah, right now KryptOn makes no attempt to protect the image once its launched other than killing keys as soon as possible after they're not needed anymore. But still, you gotta have *some* keys in memory, how else can you decrypt or sign? I don't see how its possible to know whether the image has been tampered since it's been launched unless you have special hardware or, at least, special VM (but then how could the VM know it was not modified to not validate itself?). It sounds even harder than knowing for sure if one is not truly crazy, or living in a simulated world (http://www.simulation-argument.com/), for example.. :) So, Bravo to you for taking this on. It's way beyond my ambition, much less ability. Regards.. Message: 1 Date: Sun, 22 Oct 2006 16:43:26 -0400 From: "Ron Teitelbaum" <Ron(a)USMedRec.com> Subject: RE: [Cryptography Team] Fortuna To: "'Cryptography Team Development List'" <cryptography(a)lists.squeakfoundation.org> Message-ID: <!&!AAAAAAAAAAAYAAAAAAAAALn4DBa9j89Bkul53Jf1ky/CgAAAEAAAABVgndAuNIVHtVtWJUGxVIwBAAAAAA==(a)USMedRec.com> Content-Type: text/plain; charset="us-ascii" Hi Chris! How are you doing? I knew that you improved secure random, and had mentioned the need for adding the accumulator. Is there more in KryptOn in terms of PRNG that is not already included in SecureRandom? I will spend some time looking at KryptOn to see if there is stuff that could be useful our overall platform in the Cryptography package. Your suggestions are welcome! Many of the ideas in Practical Cryptography especially keeping secrets - Data retention by Memory 9.3.4 using Fortuna (with a proper accumulator) as a PRNG seem to be quite sufficient ways to protect Secure Channel keys on a client machine. Even knowing how it all works, I would think it would be very difficult for me to break the code, unless I was able to introduce new code into the running system. So if we can solve the problem of introducing new code, and we could add Fortuna and some of the requirements Practical Cryptography for protecting secrets I would think we are a long way towards making a very secure channel implementation for a client system. I hope that you will consider helping out with all this! Nice to hear from you! Ron > -----Original Message----- > From: cryptography-bounces(a)lists.squeakfoundation.org > [mailto:cryptography-bounces@lists.squeakfoundation.org] On Behalf Of > Chris Muller > Sent: Saturday, October 21, 2006 12:13 PM > To: cryptography(a)lists.squeakfoundation.org > Subject: [Cryptography Team] Fortuna > > > PRNG I plan to work on Bruce's FORTUNA implementation for squeak. > > Hi, KryptOn is an all-Smalltalk implementation of purely the ideas in > Practical Cryptography. I have already implemented the Fortuna generator > as specified in Chapter 10 (via AES in Bruce's preferred CTR mode). > > Perhaps you would like to do the accumulator? > > - Chris > > > > _______________________________________________ > Cryptography mailing list > Cryptography(a)lists.squeakfoundation.org > http://lists.squeakfoundation.org/cgi-bin/mailman/listinfo/cryptography ------------------------------ _______________________________________________ Cryptography mailing list Cryptography(a)lists.squeakfoundation.org http://lists.squeakfoundation.org/cgi-bin/mailman/listinfo/cryptography End of Cryptography Digest, Vol 12, Issue 30 ********************************************

2 1

Minnow WIKI Status
by Ron Teitelbaum 23 Oct '06

23 Oct '06

All, The cryptography team is going to do some documentation on wiki. Can anyone please tell me the status of Minnow? Are we going to move the wiki to somewhere else? Will minnow content be moved; is it safe to use it now? Thanks, Ron Teitelbaum Squeak Cryptography Team Leader

3 2

Fortuna
by Chris Muller 22 Oct '06

22 Oct '06

> PRNG I plan to work on Bruce's FORTUNA implementation for squeak. Hi, KryptOn is an all-Smalltalk implementation of purely the ideas in Practical Cryptography. I have already implemented the Fortuna generator as specified in Chapter 10 (via AES in Bruce's preferred CTR mode). Perhaps you would like to do the accumulator? - Chris

2 1

Re: [Cryptography Team] Common Criteria Documentation...
by Kyle Hamilton 20 Oct '06

20 Oct '06

I've updated it with my comments. Since the system is written in itself (and runs inside itself), there are several things in the PP that require redesigning very large parts of the system. We need at least one VM hacker on this list to evaluate the feasability of some of the needed changes. Note: The current wiki system is probably not going to be sufficient for long-term usage. Part of the EAL that we need to meet includes positive authorized user identification for all changes to the configuration... and since documentation (and an audit trail and history) will be a major part of proving our case to the assurance labs, I'm thinking that we should treat it as part of the configuration. We'll need individual usernames and passwords for the modifications until we get X.509/PKI up and running, then we'll possibly be able to use PK crypto certificates for authentication. I'll leave it up to Krishna to determine the actual policy and implementation, since he's got formal validation experience. I just know what I've read in the CC PDFs and the single-layer OS/moderate environment document, and I'm interpreting it in the most secure (and most trust-pessimistic) manner that I can. Here's hoping that we get at least one validation out of this in the end. :) -Kyle H On 10/17/06, Krishna Sankar <ksankar(a)doubleclix.net> wrote: > Have started to put the task list and notes in our cryptography Wiki page at > http://minnow.cc.gatech.edu/squeak/5776. > > For now, the cc information is at the end of the cryptography page. As we > add more details and get a fix on the organization, we can start a set of > new pages. > > Kyle, can you pl add your notes and observations ? Thanks. > > Cheers > <k/> > > > -----Original Message----- > > From: cryptography-bounces(a)lists.squeakfoundation.org > > [mailto:cryptography-bounces@lists.squeakfoundation.org] On > > Behalf Of Krishna Sankar > > Sent: Tuesday, October 17, 2006 9:46 AM > > To: Ron(a)USMedRec.com; 'Cryptography Team Development List' > > Subject: RE: [Cryptography Team] Common Criteria Documentation... > > > > > http://code.google.com/p/squeak-cc-validation/ = Validation > > > documentation, plan and test results, bug tracking. This > > should not > > > hold code. > > <KS> > > > > I would prefer to hold the validation documentation, > > plan and test results in a Wiki. That way we have built-in > > revision control as well as history tracking. In that sense > > the Google projects do not help us. > > > > The bug tracking in Google projects is fine. > > > > </KS> > > > > > -----Original Message----- > > > From: cryptography-bounces(a)lists.squeakfoundation.org > > > [mailto:cryptography-bounces@lists.squeakfoundation.org] On > > Behalf Of > > > Ron Teitelbaum > > > Sent: Tuesday, October 17, 2006 9:34 AM > > > To: 'Cryptography Team Development List' > > > Subject: RE: [Cryptography Team] Common Criteria Documentation... > > > > > > I thought the idea was to us SVN for those documents? If more is > > > needed let's just use the wiki that is part of > > > www.squeaksource.com/Cryptography > > > > > > It's not a full wiki in that it doesn't appear to support > > file uploads > > > but that what I thought the google source was for. > > > > > > Can we map out what our requirements are and what our current > > > resources are for meeting those requirements, then we can > > look at what > > > more we need. > > > > > > What I see is: > > > > > > www.squeaksoruce.com/Cryptography = Code Repository and limited wiki > > > > > > http://code.google.com/p/squeak-cc-validation/ = Validation > > > documentation, plan and test results, bug tracking. This > > should not > > > hold code. > > > > > > cryptography(a)lists.squeakfoundation.org is our mailing list. > > > > > > Ron > > > > > > > -----Original Message----- > > > > From: cryptography-bounces(a)lists.squeakfoundation.org > > > > [mailto:cryptography-bounces@lists.squeakfoundation.org] On > > > Behalf Of > > > > Krishna Sankar > > > > Sent: Tuesday, October 17, 2006 11:11 AM > > > > To: 'Cryptography Team Development List' > > > > Subject: RE: [Cryptography Team] Common Criteria Documentation... > > > > > > > > Kyle, > > > > > > > > Can you see if you have the SVN write access ? > > > > All, > > > > Just as FYI, we need gmail address to become part of the Google > > > > project and it has no Wiki. Any thoughts on the Wiki for us to > > > > document the functionalities and the results of > > > development/testing ? > > > > > > > > Cheers > > > > <k/> > > > > > > > > > -----Original Message----- > > > > > From: cryptography-bounces(a)lists.squeakfoundation.org > > > > > [mailto:cryptography-bounces@lists.squeakfoundation.org] > > > On Behalf > > > > > Of Kyle Hamilton > > > > > Sent: Monday, October 16, 2006 8:33 PM > > > > > To: Cryptography Team Development List > > > > > Subject: [Cryptography Team] Common Criteria Documentation... > > > > > > > > > > I found the Google Code project that Krishna started, and > > > uploaded > > > > > the Common Criteria documentation I found (in PDF > > > > > form) to it as an issue. > > > > > Unfortunately, I don't have SVN write access, and I > > > don't know how > > > > > to get it either. > > > > > > > > > > After reading it, I realized that it /IS/ a good idea > > for anyone > > > > > starting on CC validation to read it before they start. It's > > > > > important to realize what it is, and what the goals > > must be. (As > > > > > well, it also helps customers -- that'd include you, Ron -- > > > > > understand what the various validation levels are, and > > > compare them > > > > > to regulatory > > > > > requirement.) > > > > > > > > > > -- > > > > > > > > > > -Kyle H > > > > > I speak only for myself. I don't have the faintest clue about > > > > > anyone else. > > > > > _______________________________________________ > > > > > Cryptography mailing list > > > > > Cryptography(a)lists.squeakfoundation.org > > > > > http://lists.squeakfoundation.org/cgi-bin/mailman/listinfo/cry > > > > > ptography > > > > > > > > > > > > > _______________________________________________ > > > > Cryptography mailing list > > > > Cryptography(a)lists.squeakfoundation.org > > > > > > > > > http://lists.squeakfoundation.org/cgi-bin/mailman/listinfo/cryptograph > > > > y > > > > > > > > > _______________________________________________ > > > Cryptography mailing list > > > Cryptography(a)lists.squeakfoundation.org > > > http://lists.squeakfoundation.org/cgi-bin/mailman/listinfo/cry > > ptography > > > > > > > _______________________________________________ > > Cryptography mailing list > > Cryptography(a)lists.squeakfoundation.org > > http://lists.squeakfoundation.org/cgi-bin/mailman/listinfo/cry > ptography > > > > _______________________________________________ > Cryptography mailing list > Cryptography(a)lists.squeakfoundation.org > http://lists.squeakfoundation.org/cgi-bin/mailman/listinfo/cryptography > -- -Kyle H

4 14

Re: [Cryptography Team] re: Common Criteria Documentation...
by Kyle Hamilton 18 Oct '06

18 Oct '06

On 10/17/06, Krishna Sankar <ksankar(a)doubleclix.net> wrote: > > there's a lot more to it than that. Are we going to split > > efforts between cryptography/FIPS and the remainder of the CC > > validation, and maybe do it more quickly? Are we going to > > focus on FIPS first, and only after we get something that we > > can submit for validation then worry about the remainder for CC? > <KS> > Yep, good thoughts. As you correctly point out, first we should aim > for the smallest subset possible; after a successful validation, we can > extend it. That way we get our infrastructure in place, the processes ironed > out and get overall experience. We still will have to address some of the > fundamental issues, but hopefully they are manageable. The fundamental design (that the VM is self-hosted) is a fundamental issue -- but, as you say, it should be manageable. It will take a lot of work, though. FIPS 140-2: - make the timequeue not a singleton, or make a usertimequeue subclass of the timequeue and call its dispatch whenever the system itself isn't doing anything (this is just an idea, I don't know how well it would work... I haven't delved into the scheduling) - Ensure that the cryptographic objects cannot be changed, cannot be reflected, and cannot be later diverted (this will be difficult) - Ensure that cryptographic objects have a critical section capability (so that the VM can't be written out while unencrypted key data is in memory) - Ensure that once a "secure mode" is set, the VM does everything it can to avoid being debugged by either a native debugger or any debugger within the VM (to avoid reflection and modification of any system object and prevent the cryptographic objects from being reflected) - Ensure there's a way to verify that the crypto code hasn't been tampered with - Ensure there's a way to verify that the system code hasn't been tampered with [etc...] CC: - Create the notion of a "security principal", and ensure that private data of one cannot be accessed by any other (including private keys, but also including processes) - Create quotas, by which VM space (and disk space, and processing time, and so on) cannot be hogged by any individual security principal [etc...] > And as Ron points out, the authenticated site et al can come after > we go thru a dry run. We should still keep a track of the activities, > results et al, but not in a strict authenticated way until we have all the > ducks in a row. Alright. I just offer ideas, as I usually do. If we don't keep track of it in a strictly-authenticated fashion, we should still be able to do it via Monticello (especially the unit tests, which should be written just to verify output from the real routines -- the CSRC at NIST has a large set of test vectors for various algorithms for informal verification of correctness, before the full validation is performed). > One important aspect we need to think about now is this minimal > subset - and what it should consist of and what it should achieve. I would think, at a minimum, that it should include implementations of: - at least one FIPS-approved symmetric-key cipher -- at least two FIPS-approved modes of operation - at least one FIPS-approved asymmetric-key cipher - at least one FIPS-approved HMAC function - at least one FIPS-approved hash function - at least one FIPS-approved pseudo-random number generation function - design interfaces to each type if they don't already exist, improve interfaces if necessary - Implementation of SSL3/TLS1/TLS1.1/TLS1.2 using defined interfaces - Implementation of ASN.1 parser and BER/DER/XER encodings of ASN.1 - Implementation of X.509v3/PKIX (aka, PKI) - Implementation of Certificate Signing Request generation - Implementation of certificate generation (self-signed, at the least, and perhaps operate as a CA) - Implementation of OpenPGP - Implementation of Image Signing/Verification > I will also read thru, understand the current environment and think > thru the paces. If we can get the cryptography engine certified, it will be > a win. Am not sure it can be done separately, though. "A CC evaluation does not supersede or replace a validation to either FIPS 140-1 or FIPS 140-2. The four security levels in FIPS 140-1 and FIPS 140-2 do not map directly to specific CC EALs or to CC functional requirements. A CC certificate cannot be a substitute for a FIPS 140-1 or FIPS 140-2 certificate." -- http://csrc.nist.gov/cryptval/140-2CC.htm I think it has to be done separately. Honestly, I'm not sure it can be done together. I'm about to upload a whole blob of FIPS, NIST special publications, and test vectors that I just downloaded from the NIST website to the Google project. (Again, just getting everything in one place, since it's been a bear to find it all in the first place.) -Kyle H

1 0

Re: [Cryptography Team] Common Criteria Documentation...
by Kyle Hamilton 18 Oct '06

18 Oct '06

You know, I'd love to, but I keep getting authentication requests and have no username or password... so, 401 Unauthorized. Unauthorized for: /squeak/* Who am I supposed to contact for editing permission? -Kyle H On 10/17/06, Krishna Sankar <ksankar(a)doubleclix.net> wrote: > > Kyle, can you pl add your notes and observations ? Thanks. > > Cheers > <k/>

2 1

RE: [Cryptography Team] Common Criteria Documentation...
by Krishna Sankar 17 Oct '06

17 Oct '06

Have started to put the task list and notes in our cryptography Wiki page at http://minnow.cc.gatech.edu/squeak/5776. For now, the cc information is at the end of the cryptography page. As we add more details and get a fix on the organization, we can start a set of new pages. Kyle, can you pl add your notes and observations ? Thanks. Cheers <k/> > -----Original Message----- > From: cryptography-bounces(a)lists.squeakfoundation.org > [mailto:cryptography-bounces@lists.squeakfoundation.org] On > Behalf Of Krishna Sankar > Sent: Tuesday, October 17, 2006 9:46 AM > To: Ron(a)USMedRec.com; 'Cryptography Team Development List' > Subject: RE: [Cryptography Team] Common Criteria Documentation... > > > http://code.google.com/p/squeak-cc-validation/ = Validation > > documentation, plan and test results, bug tracking. This > should not > > hold code. > <KS> > > I would prefer to hold the validation documentation, > plan and test results in a Wiki. That way we have built-in > revision control as well as history tracking. In that sense > the Google projects do not help us. > > The bug tracking in Google projects is fine. > > </KS> > > > -----Original Message----- > > From: cryptography-bounces(a)lists.squeakfoundation.org > > [mailto:cryptography-bounces@lists.squeakfoundation.org] On > Behalf Of > > Ron Teitelbaum > > Sent: Tuesday, October 17, 2006 9:34 AM > > To: 'Cryptography Team Development List' > > Subject: RE: [Cryptography Team] Common Criteria Documentation... > > > > I thought the idea was to us SVN for those documents? If more is > > needed let's just use the wiki that is part of > > www.squeaksource.com/Cryptography > > > > It's not a full wiki in that it doesn't appear to support > file uploads > > but that what I thought the google source was for. > > > > Can we map out what our requirements are and what our current > > resources are for meeting those requirements, then we can > look at what > > more we need. > > > > What I see is: > > > > www.squeaksoruce.com/Cryptography = Code Repository and limited wiki > > > > http://code.google.com/p/squeak-cc-validation/ = Validation > > documentation, plan and test results, bug tracking. This > should not > > hold code. > > > > cryptography(a)lists.squeakfoundation.org is our mailing list. > > > > Ron > > > > > -----Original Message----- > > > From: cryptography-bounces(a)lists.squeakfoundation.org > > > [mailto:cryptography-bounces@lists.squeakfoundation.org] On > > Behalf Of > > > Krishna Sankar > > > Sent: Tuesday, October 17, 2006 11:11 AM > > > To: 'Cryptography Team Development List' > > > Subject: RE: [Cryptography Team] Common Criteria Documentation... > > > > > > Kyle, > > > > > > Can you see if you have the SVN write access ? > > > All, > > > Just as FYI, we need gmail address to become part of the Google > > > project and it has no Wiki. Any thoughts on the Wiki for us to > > > document the functionalities and the results of > > development/testing ? > > > > > > Cheers > > > <k/> > > > > > > > -----Original Message----- > > > > From: cryptography-bounces(a)lists.squeakfoundation.org > > > > [mailto:cryptography-bounces@lists.squeakfoundation.org] > > On Behalf > > > > Of Kyle Hamilton > > > > Sent: Monday, October 16, 2006 8:33 PM > > > > To: Cryptography Team Development List > > > > Subject: [Cryptography Team] Common Criteria Documentation... > > > > > > > > I found the Google Code project that Krishna started, and > > uploaded > > > > the Common Criteria documentation I found (in PDF > > > > form) to it as an issue. > > > > Unfortunately, I don't have SVN write access, and I > > don't know how > > > > to get it either. > > > > > > > > After reading it, I realized that it /IS/ a good idea > for anyone > > > > starting on CC validation to read it before they start. It's > > > > important to realize what it is, and what the goals > must be. (As > > > > well, it also helps customers -- that'd include you, Ron -- > > > > understand what the various validation levels are, and > > compare them > > > > to regulatory > > > > requirement.) > > > > > > > > -- > > > > > > > > -Kyle H > > > > I speak only for myself. I don't have the faintest clue about > > > > anyone else. > > > > _______________________________________________ > > > > Cryptography mailing list > > > > Cryptography(a)lists.squeakfoundation.org > > > > http://lists.squeakfoundation.org/cgi-bin/mailman/listinfo/cry > > > > ptography > > > > > > > > > > _______________________________________________ > > > Cryptography mailing list > > > Cryptography(a)lists.squeakfoundation.org > > > > > > http://lists.squeakfoundation.org/cgi-bin/mailman/listinfo/cryptograph > > > y > > > > > > _______________________________________________ > > Cryptography mailing list > > Cryptography(a)lists.squeakfoundation.org > > http://lists.squeakfoundation.org/cgi-bin/mailman/listinfo/cry > ptography > > > > _______________________________________________ > Cryptography mailing list > Cryptography(a)lists.squeakfoundation.org > http://lists.squeakfoundation.org/cgi-bin/mailman/listinfo/cry ptography >

1 0

Re: [Cryptography Team] Common Criteria Documentation...
by Kyle Hamilton 17 Oct '06

17 Oct '06

I do have SVN write access now, thank you. I've placed the Common Criteria documents (as well as the Evaluation Methodology document, and a couple of supplementary materials) in the repository as the test. What is our source control plan? "Only project members, as agreed by Krishna and Ron through some 'hiring-type' process, shall have write access to the repository"? Also, EAL 3 and 4 require a "controlled development environment". I'm not entirely certain what this means (likely that there is a low possibility for viruses or other attack vectors that could create unauthorized changes to the source)... I wonder if we can meet this requirement using VMware player and a customized VM image, perhaps Ubuntu 6.06LTS with all development tools installed and only security updates. (We need to examine the Evaluation Methodology document to understand this requirement and requirements of implementation.) For Windows, I have MSDN Windows 2000 that I can install in a VM. I don't like XP nor Vista, and am well-familiar with 2000. I can also install VC++ 2005 Express Edition, as necessary, and (if we choose to use OpenSSL on the Windows platform) the toolchain required to build the FIPS-validated version of that as well. (I also have a validly licensed copy of VMware 4.5 within which I can build customized VM images.) Remember, documentation of the process and any modifications to the environments is key. -Kyle H On 10/17/06, Krishna Sankar <ksankar(a)doubleclix.net> wrote: > Kyle, > > Can you see if you have the SVN write access ? > All, > Just as FYI, we need gmail address to become part of the Google > project and it has no Wiki. Any thoughts on the Wiki for us to document the > functionalities and the results of development/testing ? > > Cheers > <k/> > > > -----Original Message----- > > From: cryptography-bounces(a)lists.squeakfoundation.org > > [mailto:cryptography-bounces@lists.squeakfoundation.org] On > > Behalf Of Kyle Hamilton > > Sent: Monday, October 16, 2006 8:33 PM > > To: Cryptography Team Development List > > Subject: [Cryptography Team] Common Criteria Documentation... > > > > I found the Google Code project that Krishna started, and > > uploaded the Common Criteria documentation I found (in PDF > > form) to it as an issue. > > Unfortunately, I don't have SVN write access, and I don't > > know how to get it either. > > > > After reading it, I realized that it /IS/ a good idea for > > anyone starting on CC validation to read it before they > > start. It's important to realize what it is, and what the > > goals must be. (As well, it also helps customers -- that'd > > include you, Ron -- understand what the various validation > > levels are, and compare them to regulatory > > requirement.) > > > > -- > > > > -Kyle H > > I speak only for myself. I don't have the faintest clue > > about anyone else. > > _______________________________________________ > > Cryptography mailing list > > Cryptography(a)lists.squeakfoundation.org > > http://lists.squeakfoundation.org/cgi-bin/mailman/listinfo/cry > > ptography > > > > _______________________________________________ > Cryptography mailing list > Cryptography(a)lists.squeakfoundation.org > http://lists.squeakfoundation.org/cgi-bin/mailman/listinfo/cryptography > -- -Kyle H

2 1

RE: [Cryptography Team] Common Criteria Documentation...
by Ron Teitelbaum 17 Oct '06

17 Oct '06

Are there other benefits besides bug tracking for having the google project? Ron > -----Original Message----- > From: cryptography-bounces(a)lists.squeakfoundation.org > [mailto:cryptography-bounces@lists.squeakfoundation.org] On Behalf Of > Krishna Sankar > Sent: Tuesday, October 17, 2006 12:46 PM > To: Ron(a)USMedRec.com; 'Cryptography Team Development List' > Subject: RE: [Cryptography Team] Common Criteria Documentation... > > > http://code.google.com/p/squeak-cc-validation/ = Validation > > documentation, plan and test results, bug tracking. This > > should not hold code. > <KS> > > I would prefer to hold the validation documentation, plan and test > results in a Wiki. That way we have built-in revision control as well as > history tracking. In that sense the Google projects do not help us. > > The bug tracking in Google projects is fine. > > </KS> > > > -----Original Message----- > > From: cryptography-bounces(a)lists.squeakfoundation.org > > [mailto:cryptography-bounces@lists.squeakfoundation.org] On > > Behalf Of Ron Teitelbaum > > Sent: Tuesday, October 17, 2006 9:34 AM > > To: 'Cryptography Team Development List' > > Subject: RE: [Cryptography Team] Common Criteria Documentation... > > > > I thought the idea was to us SVN for those documents? If > > more is needed let's just use the wiki that is part of > > www.squeaksource.com/Cryptography > > > > It's not a full wiki in that it doesn't appear to support > > file uploads but that what I thought the google source was for. > > > > Can we map out what our requirements are and what our current > > resources are for meeting those requirements, then we can > > look at what more we need. > > > > What I see is: > > > > www.squeaksoruce.com/Cryptography = Code Repository and limited wiki > > > > http://code.google.com/p/squeak-cc-validation/ = Validation > > documentation, plan and test results, bug tracking. This > > should not hold code. > > > > cryptography(a)lists.squeakfoundation.org is our mailing list. > > > > Ron > > > > > -----Original Message----- > > > From: cryptography-bounces(a)lists.squeakfoundation.org > > > [mailto:cryptography-bounces@lists.squeakfoundation.org] On > > Behalf Of > > > Krishna Sankar > > > Sent: Tuesday, October 17, 2006 11:11 AM > > > To: 'Cryptography Team Development List' > > > Subject: RE: [Cryptography Team] Common Criteria Documentation... > > > > > > Kyle, > > > > > > Can you see if you have the SVN write access ? > > > All, > > > Just as FYI, we need gmail address to become part of the Google > > > project and it has no Wiki. Any thoughts on the Wiki for us to > > > document the functionalities and the results of > > development/testing ? > > > > > > Cheers > > > <k/> > > > > > > > -----Original Message----- > > > > From: cryptography-bounces(a)lists.squeakfoundation.org > > > > [mailto:cryptography-bounces@lists.squeakfoundation.org] > > On Behalf > > > > Of Kyle Hamilton > > > > Sent: Monday, October 16, 2006 8:33 PM > > > > To: Cryptography Team Development List > > > > Subject: [Cryptography Team] Common Criteria Documentation... > > > > > > > > I found the Google Code project that Krishna started, and > > uploaded > > > > the Common Criteria documentation I found (in PDF > > > > form) to it as an issue. > > > > Unfortunately, I don't have SVN write access, and I > > don't know how > > > > to get it either. > > > > > > > > After reading it, I realized that it /IS/ a good idea for anyone > > > > starting on CC validation to read it before they start. It's > > > > important to realize what it is, and what the goals must be. (As > > > > well, it also helps customers -- that'd include you, Ron -- > > > > understand what the various validation levels are, and > > compare them > > > > to regulatory > > > > requirement.) > > > > > > > > -- > > > > > > > > -Kyle H > > > > I speak only for myself. I don't have the faintest clue about > > > > anyone else. > > > > _______________________________________________ > > > > Cryptography mailing list > > > > Cryptography(a)lists.squeakfoundation.org > > > > http://lists.squeakfoundation.org/cgi-bin/mailman/listinfo/cry > > > > ptography > > > > > > > > > > _______________________________________________ > > > Cryptography mailing list > > > Cryptography(a)lists.squeakfoundation.org > > > > > http://lists.squeakfoundation.org/cgi-bin/mailman/listinfo/cryptograph > > > y > > > > > > _______________________________________________ > > Cryptography mailing list > > Cryptography(a)lists.squeakfoundation.org > > http://lists.squeakfoundation.org/cgi-bin/mailman/listinfo/cry > ptography > > > > _______________________________________________ > Cryptography mailing list > Cryptography(a)lists.squeakfoundation.org > http://lists.squeakfoundation.org/cgi-bin/mailman/listinfo/cryptography

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

Cryptography October 2006