Cryptography October 2006

cryptography@lists.squeakfoundation.org

13 participants
38 discussions

RE: [Cryptography Team] Common Criteria Documentation...
by Ron Teitelbaum 17 Oct '06

17 Oct '06

I thought the idea was to us SVN for those documents? If more is needed let's just use the wiki that is part of www.squeaksource.com/Cryptography It's not a full wiki in that it doesn't appear to support file uploads but that what I thought the google source was for. Can we map out what our requirements are and what our current resources are for meeting those requirements, then we can look at what more we need. What I see is: www.squeaksoruce.com/Cryptography = Code Repository and limited wiki http://code.google.com/p/squeak-cc-validation/ = Validation documentation, plan and test results, bug tracking. This should not hold code. cryptography(a)lists.squeakfoundation.org is our mailing list. Ron > -----Original Message----- > From: cryptography-bounces(a)lists.squeakfoundation.org > [mailto:cryptography-bounces@lists.squeakfoundation.org] On Behalf Of > Krishna Sankar > Sent: Tuesday, October 17, 2006 11:11 AM > To: 'Cryptography Team Development List' > Subject: RE: [Cryptography Team] Common Criteria Documentation... > > Kyle, > > Can you see if you have the SVN write access ? > All, > Just as FYI, we need gmail address to become part of the Google > project and it has no Wiki. Any thoughts on the Wiki for us to document > the > functionalities and the results of development/testing ? > > Cheers > <k/> > > > -----Original Message----- > > From: cryptography-bounces(a)lists.squeakfoundation.org > > [mailto:cryptography-bounces@lists.squeakfoundation.org] On > > Behalf Of Kyle Hamilton > > Sent: Monday, October 16, 2006 8:33 PM > > To: Cryptography Team Development List > > Subject: [Cryptography Team] Common Criteria Documentation... > > > > I found the Google Code project that Krishna started, and > > uploaded the Common Criteria documentation I found (in PDF > > form) to it as an issue. > > Unfortunately, I don't have SVN write access, and I don't > > know how to get it either. > > > > After reading it, I realized that it /IS/ a good idea for > > anyone starting on CC validation to read it before they > > start. It's important to realize what it is, and what the > > goals must be. (As well, it also helps customers -- that'd > > include you, Ron -- understand what the various validation > > levels are, and compare them to regulatory > > requirement.) > > > > -- > > > > -Kyle H > > I speak only for myself. I don't have the faintest clue > > about anyone else. > > _______________________________________________ > > Cryptography mailing list > > Cryptography(a)lists.squeakfoundation.org > > http://lists.squeakfoundation.org/cgi-bin/mailman/listinfo/cry > > ptography > > > > _______________________________________________ > Cryptography mailing list > Cryptography(a)lists.squeakfoundation.org > http://lists.squeakfoundation.org/cgi-bin/mailman/listinfo/cryptography

2 1

Re: [Cryptography Team] Common Criteria Documentation...
by Kyle Hamilton 17 Oct '06

17 Oct '06

For a wiki, we can try wikia.com... the subject matter may be too specialized for them, though. We could fairly easily make the wiki self-hosting, using the wiki software in the Monticello repositories (I think SqueakSource, but not entirely sure). What kind of outlay can the Squeak Foundation afford for wiki hosting, if necessary? -Kyle H On 10/16/06, Krishna Sankar <ksankar(a)doubleclix.net> wrote: > I am still figuring out things with the Google project. By tomorrow cob, > will see how we all can get SVN write access. BTW, for the records, the > Google project is squeak-cc-validation > http://code.google.com/p/squeak-cc-validation/. > > On the CC side, I think the major tasks are : > > 1. Decide on the protection profile(s) we want to address > > 2. Define the claims and security target > > Most probably we would need 3-4 configurations > > 3. Start a function List and Test Matrix (Where can we host a > Wiki?) (This will help us prove our case, so we should start this task ASAP) > > 4. Develop the ToE > > 5. Understand and document the cc process relevant to us. Read > and mark the cc documents, talk with Labs et al > > 6. Formal cc effort > > Kyle, the cc documentation will help us in these tasks. I will add these > tasks and will start double-clicking task #1. > > Cheers > <k/> > > > -----Original Message----- > > From: cryptography-bounces(a)lists.squeakfoundation.org > > [mailto:cryptography-bounces@lists.squeakfoundation.org] On > > Behalf Of Kyle Hamilton > > Sent: Monday, October 16, 2006 8:33 PM > > To: Cryptography Team Development List > > Subject: [Cryptography Team] Common Criteria Documentation... > > > > I found the Google Code project that Krishna started, and > > uploaded the Common Criteria documentation I found (in PDF > > form) to it as an issue. > > Unfortunately, I don't have SVN write access, and I don't > > know how to get it either. > > > > After reading it, I realized that it /IS/ a good idea for > > anyone starting on CC validation to read it before they > > start. It's important to realize what it is, and what the > > goals must be. (As well, it also helps customers -- that'd > > include you, Ron -- understand what the various validation > > levels are, and compare them to regulatory > > requirement.) > > > > -- > > > > -Kyle H > > I speak only for myself. I don't have the faintest clue > > about anyone else. > > _______________________________________________ > > Cryptography mailing list > > Cryptography(a)lists.squeakfoundation.org > > http://lists.squeakfoundation.org/cgi-bin/mailman/listinfo/cry > ptography > > > > _______________________________________________ > Cryptography mailing list > Cryptography(a)lists.squeakfoundation.org > http://lists.squeakfoundation.org/cgi-bin/mailman/listinfo/cryptography > -- -Kyle H

1 0

Common Criteria Documentation...
by Kyle Hamilton 17 Oct '06

17 Oct '06

I found the Google Code project that Krishna started, and uploaded the Common Criteria documentation I found (in PDF form) to it as an issue. Unfortunately, I don't have SVN write access, and I don't know how to get it either. After reading it, I realized that it /IS/ a good idea for anyone starting on CC validation to read it before they start. It's important to realize what it is, and what the goals must be. (As well, it also helps customers -- that'd include you, Ron -- understand what the various validation levels are, and compare them to regulatory requirement.) -- -Kyle H I speak only for myself. I don't have the faintest clue about anyone else.

2 2

File repository?
by Kyle Hamilton 13 Oct '06

13 Oct '06

Is there a place where interested parties can upload useful binary documents (such as the Derived Test Requirements document that forms the basis for FIPS 140-2 testing), as well as metadata describing what it is and where it was obtained? I'd like something like CVS, SVN, or git -- but the actual mechanism doesn't matter as long as it's accessible to every platform that Squeak runs on. Unfortunately, since there's no PDF viewer in Squeak, I don't think that an in-Squeak solution would be appropriate. However, I'm not a member of the team (other than as a volunteer), and so I'm perfectly happy and willing to be overruled. :) -- -Kyle H

3 5

[ANN] Squeak Cryptography Certification Validation Officer
by Ron Teitelbaum 13 Oct '06

13 Oct '06

All, We are very pleased to announce the addition of a new team member. Krishna Sankar is joining our team as the new Squeak Cryptography Certification Validation Officer. The goal of this position is to set a path for the cryptography team to ensure that the Squeak Cryptography code meets the FIPS common criteria http://niap.bahialab.com/cc-scheme/cc_docs/index.cfm which a first step on the path to FIPS certification. Krishna has a distinguished security background, has worked with a number of government standards, has lead a workshop for Cisco on NIST PKI http://middleware.internet2.edu/pki04/ , is a lead author for Cisco Press WLAN Security book - http://www.ciscopress.com/authors/bio.asp?a=9ed11cfa-9067-4205-8110-76358f31 7825&rl=1 , and also contributes to OLPC. We are very excited to have Krishna join our efforts. We are still searching for volunteers. I would like to encourage anyone that is even remotely interested in cryptography to join our efforts. This is the perfect time for you to join the group http://lists.squeakfoundation.org/mailman/listinfo/cryptography . If you need cryptography in your applications, working on our common criteria validation effort will help you learn about cryptography and will teach you about the common criteria process so that you can apply what you learn to your own application. We are working to divide the tasks into manageable chunks so that individual developers can pick up a single piece and contribute. We are organizing the effort so that we can track, validate and get proper feedback as to our progress. We have no deadline, only a path to follow. Please help me welcome Krishna Sankar, Ron Teitelbaum Squeak Cryptography Team Leader President / Principal Software Engineer US Medical Record Specialists Ron(a)USMedRec.com

3 8

Re: [ANN] Working SSL In Squeak
by Bill Schwab 12 Oct '06

12 Oct '06

Hans-Martin, ========================== > Just to clarify, is this a discussion regarding where a plugin or DLL > belongs, or regarding whether we need one at all? > I think both: ========================== Good thing I asked :) ========================== 1. We need a primitive - the Smalltalk code is too slow to be usable. ========================== That is as I would expect. Should I be surprised by the results? ========================== 2. It should be in the base VM because it should be easy to access, without downloading, compiling, installing etc. That was the point in making the Smalltalk implementation compatible to the plugin, so that we could use it in cases where the plugin is not available. But if the plugin is built-in, that point becomes moot. ========================== The down side is that it becomes (potentially) more difficult to upgrade it. However, one can misconfigure systems of almost any design. It might be a good idea to build a version number check into it so that newer images will refuse to run against sufficiently dated VM code, or something like that. It would have to blow up in a way that: (1) won't crash Squeak[*]; (2) does not silently send clear text. Bill [*] I mention it because my OpenSSL package for Dolphin crashes the image quite badly when the DLL is not present. I tolerate it, but would not want to foist such junk on others :) Wilhelm K. Schwab, Ph.D. University of Florida Department of Anesthesiology PO Box 100254 Gainesville, FL 32610-0254 Email: bills(a)anest4.anest.ufl.edu Tel: (352) 846-1285 FAX: (352) 392-7029

1 0

Include Cryptographic Primitives In VM's - DESPlugin
by Ron Teitelbaum 12 Oct '06

12 Oct '06

http://bugs.impara.de/view.php?id=5228 : Hans-Martin did some testing and as we expected the performance of pure squeak cryptography is disappointing: Hans-Martin wrote: "Ok, I did some measurements. Results are pretty disappointing. Squeak on my AMD 3800+ processor encrypts 32 KBytes using 3DES CBC mode in about 8 seconds - unusable for anything but a proof-of-concept. Therefore I think that DES (and maybe some other small cryptographic primitives) should be part of the base VM." The DESPlugin is already a part of the VMMaker, I am asking the VM group to please include the DESPlugin in the base VM that is distrubuted. We will be submitting more code and will follow the process of code -> VMMaker -> VM. If the VM team wants to wait before building a new VM's until other primitives are available, that is fine, but if a build is going to be done anyway for other issues, please include the DESPlugin. Thank you for your help! Ron Teitelbaum Cryptography Team Leader

2 5

Re: [ANN] Working SSL In Squeak
by Bill Schwab 12 Oct '06

12 Oct '06

Hans-Martin, Ron, ====================================== > I did not do any comparison because I did not yet download the DES > plugin - just wanted to make this thing work in the unit tests before > going to bed :-) I just added a very thin layer (mostly converting from > ByteArrays to LargeIntegers and vice versa) to use my old code mostly > unchanged. The performance can probably be improved a bit by changing > that old code to directly work with ByteArrays. > Ok, I did some measurements. Results are pretty disappointing. Squeak on my AMD 3800+ processor encrypts 32 KBytes using 3DES CBC mode in about 8 seconds - unusable for anything but a proof-of-concept. Therefore I think that DES (and maybe some other small cryptographic primitives) should be part of the base VM. ====================================== Just to clarify, is this a discussion regarding where a plugin or DLL belongs, or regarding whether we need one at all? Bill Wilhelm K. Schwab, Ph.D. University of Florida Department of Anesthesiology PO Box 100254 Gainesville, FL 32610-0254 Email: bills(a)anest4.anest.ufl.edu Tel: (352) 846-1285 FAX: (352) 392-7029

2 1

Re: [ANN] Working SSL In Squeak
by Hans-Martin Mosner 11 Oct '06

11 Oct '06

Robert Withers schrieb: > Hi Stef, > > The DESPlugin implements the DES cryptography algorithm, which has > basically two parts. Key preparation, which DES calls "cooking the > key", and transformation, where it takes the cooked key and the input > block and encrypts it or decrypts it. I have always wished that there > were an in-image implementation so that the plugin isn't required when > doing DES, but it hasn't happened yet. Something to work on, > perhaps. Note that I didn't write it, I am only a user. The in-image implementation existed as part of my OpenPGP efforts, and I've now ported it to the Cryptography framework. Load the MC packages CryptographyBase-hmm.18 and Cryptography-DES-hmm.3 to use it. BTW, the SSL example workspace assumes that #asURL is able to create a HttpsUrl. But that ain't so. Looking at the #asUrl code, I saw that at least in 3.8.1 this is not written with extensions in mind. Does 3.9 have a more extensible method there? (I'm too tired to look myself right now). Cheers, Hans-Martin

3 5

RE: [Cryptography Team] RE: Cryptography Team leader mistake
by Ron Teitelbaum 11 Oct '06

11 Oct '06

Thank you. Welcome to the team! Ron Teitelbaum > -----Original Message----- > From: cryptography-bounces(a)lists.squeakfoundation.org > [mailto:cryptography-bounces@lists.squeakfoundation.org] On Behalf Of > Krishna Sankar > Sent: Wednesday, October 11, 2006 3:11 PM > To: Ron(a)USMedRec.com; 'Cryptography Team Development List' > Subject: [Cryptography Team] RE: Cryptography Team leader mistake > > No problems. Actually it turned out to be good ! I was agonizing on a > concise intro ;o) Hence the delay. > > I am interested and would be happy to contribute on any appropriate role. > > Cheers > <k/> > ________________________________ > > From: Ron Teitelbaum [mailto:Ron@USMedRec.com] > Sent: Wednesday, October 11, 2006 10:42 AM > To: 'Cryptography Team Development List' > Cc: 'Krishna Sankar' > Subject: Cryptography Team leader mistake > > > > All, > > > > I'm really sorry about the last email. I sent it by mistake to the > group. (I typed the address in the email so that I could get the address > to > paste to Krishna Sankar). I hit send and tried to stop it but could not! > > > > I apologize for the mistake to it was a very foolish thing to do! > > > > Ron Teitelbaum > > > _______________________________________________ > Cryptography mailing list > Cryptography(a)lists.squeakfoundation.org > http://lists.squeakfoundation.org/cgi-bin/mailman/listinfo/cryptography

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

Cryptography October 2006