Cryptography October 2006

cryptography@lists.squeakfoundation.org

13 participants
38 discussions

Cryptography Team leader mistake
by Ron Teitelbaum 11 Oct '06

11 Oct '06

All, I'm really sorry about the last email. I sent it by mistake to the group. (I typed the address in the email so that I could get the address to paste to Krishna Sankar). I hit send and tried to stop it but could not! I apologize for the mistake to it was a very foolish thing to do! Ron Teitelbaum

2 1

RE: [Cryptography Team] Welcome New Members and Update
by Ron Teitelbaum 11 Oct '06

11 Oct '06

Hi Krishna, If you are still interested in joining the group, I thought I'd remind you to introduce yourself to the team: cryptography(a)lists.squeakfoundation.org Thank you for your interest, I'm looking forward to working with you! Ron Teitelbaum > -----Original Message----- > From: Krishna Sankar [mailto:ksankar@doubleclix.net] > Sent: Monday, October 09, 2006 4:28 PM > To: Ron(a)USMedRec.com > Subject: RE: [Cryptography Team] Welcome New Members and Update > > Thanks. Some answers. > > > > What brings you to Smalltalk in general? What is your > > experience with the language? > > > <KS> > I got introduced to Squeak thru the OLPC effort. Have been thinking > about designing a program to introduce Chamber Music to kids. I also have > been studying the various aspects of OLPC, mesh networking et al. > > I am new to Smalltalk. Have worked on languages from FORTRAN to > Pascal to Ada to COBOL to Java. Have been looking for an opportunity to > work on Smalltalk (without a goal usually the work would be peripheral)... > May be this is one, may be not. > </KS> > > What made you want to join the team, what are you looking to > > get out of your participation? > > > <KS> > This is an interesting problem - from implementation thru > certification - especially in the security domain; experience in open > source work, programming (I like to program stuff, sometimes get too much > into the .ppt land ;o(), exploring nuances of cryptography, experience in > Smalltalk and finally contribution to OLPC. > </KS> > > Your background in government standards and background in > > cryptography would certainly qualify you to organize our > > efforts. I look forward to discussing it with you and other > > members of the team. Could you give me some more info on you > > background? I would be interested in reading your stuff, can > > you point me to your work? > > > <KS> > Here is a quick list of security related stuff. Pl let me know if this is > enough. > > My background is in interpreting and developing software as per government > standards like MIL-STD-1521/1520, MIL-STD-490/498/499 and DoD-STD- > 2167A/2168. Also was involved reviewing network related documents. > > I am the lead author of the Cisco Press WLAN Security book - > http://www.ciscopress.com/authors/bio.asp?a=9ed11cfa-9067-4205-8110- > 76358f317825&rl=1 > > When java was new, I had been part of a few Java Books - now they all look > very old and trivial ;o( In my book Java 1.2 Class Libraries Unleashed, I > had covered the cryptography as well. > > I also have been involved with the NIST/Internet2 PKI workshop - > http://middleware.internet2.edu/pki04/ > > I also was part of Web Services standards like SAML et al. > > Also have been doing security stuff as a part of my work for sometime. > > </KS> > > Cheers > <k/> > > -----Original Message----- > > From: Ron Teitelbaum [mailto:Ron@USMedRec.com] > > Sent: Monday, October 09, 2006 11:00 AM > > To: 'Krishna Sankar' > > Subject: RE: [Cryptography Team] Welcome New Members and Update > > > > Krishna, > > > > Thank you for volunteering, I will be very happy to help you > > in any way I can. I have some questions for you. > > > > What brings you to Smalltalk in general? What is your > > experience with the language? > > > > What made you want to join the team, what are you looking to > > get out of your participation? > > > > Your background in government standards and background in > > cryptography would certainly qualify you to organize our > > efforts. I look forward to discussing it with you and other > > members of the team. Could you give me some more info on you > > background? I would be interested in reading your stuff, can > > you point me to your work? > > > > As for the slang code in squeak for SHA256: There are already > > plug-in written for SHA1, which can serve as a working > > prototype of the things that could be done for SHA256. I > > wrote the SHA256 Smalltalk code and I used the SHA1 > > implementation as a guide. The similarity should definitely > > make writing the plug-in much easier. You would need to load > > the VMMaker to get the SHA1 code. Are you familiar with the > > VMMaker or slang? > > > > I look forward to working with you! > > > > Ron > > > > > > > From: Krishna Sankar > > > Sent: Monday, October 09, 2006 1:21 PM > > > > > > Ron, > > > > > > Thanks for the e-mail. Even though this is a personal > > e-mail to you, > > > I will send an intro to the list. > > > > > > I would be happy to work on the Cryptography Security > > Validation > > > effort. While I do not have background on Common Criteria, > > I am well > > > versed with most of the cryptography aspects (I also have > > written on > > > WLAN security as well as Java Security plus have been involved with > > > PKI NIST workshop et al) I also have background on Govt standards. > > > Would this be sufficient to participate, may be even as a sub-lead ? > > > > > > May be it is a good idea to start with the SHA256 > > plug-in. Would > > > appreciate your thoughts on the efforts and guidance, as this is my > > > first foray into Squeak. > > > > > > Cheers > > > <k/> > > > > -----Original Message----- > > > > From: cryptography-bounces(a)lists.squeakfoundation.org > > > > [mailto:cryptography-bounces@lists.squeakfoundation.org] > > On Behalf > > > > Of Ron Teitelbaum > > > > Sent: Monday, October 09, 2006 9:26 AM > > > > To: 'Cryptography Team Development List' > > > > Subject: [Cryptography Team] Welcome New Members and Update > > > > > > > > All, > > > > > > > > We have a few new members. I would like to welcome you > > to the list > > > > and invite you to introduce yourselves to the list if you feel so > > > > inclined and please let us know what your interests in > > cryptography > > > > are, and what you hope to get from this group. > > > > > > > > We have discussed previously that we might want to build > > Slang plug > > > > in representations of some of our cryptographic primitives to > > > > improve performance. There appears to be support for including > > > > those primitives internally in the base VM for the different > > > > platforms, I would like to take advantage of this > > opportunity. If > > > > anyone has a plug in they would like to have included in the VM > > > > maker and then in new VM Builds please submit it to this list for > > > > review. (Rob could you enter a mantis bug requesting that we > > > > include the DES plug in with future builds of VM’s?). We > > need the > > > > SHA256 plug in written (I have not had time to do it ☹, > > but I will > > > > get to it if nobody volunteers). Are there suggestions for other > > > > plug ins that need to be written? > > > > > > > > Also I would like us to consider looking at the fips > > common criteria > > > > http://niap.bahialab.com/cc-scheme/cc_docs/index.cfm > > > > . My feeling is that more testing can not be bad for our > > > > cryptography code, and that the more we can accomplish in > > this area > > > > the closer we are to considering getting certified ourselves. It > > > > does not make sense to hire a lab until we are satisfied > > internally > > > > that we will pass. > > > > > > > > Because this is a large process it would be easy to consider this > > > > too difficult a task to complete. The major reason to > > discount this > > > > problem is that we have no deadline. This means that with proper > > > > organization anyone with some spare time can contribute > > and move us > > > > forward. What we need is someone to help provide this > > organization. > > > > That person needs to be very familiar with the common criteria, > > > > should have considerable experience in the cryptography field and > > > > should have good organization skills. The job is not complicated > > > > and I don’t expect that it should take much time (about 1 hour a > > > > month after initial startup). That person would be > > responsible for > > > > developing a short list of tasks that need to be > > accomplished, would > > > > work to help find people to validate work that is already > > completed, > > > > and would tell the community when the work is done. I > > would suggest > > > > that this person would carry the official title of Squeak > > > > Cryptography Security Validation Officer. > > > > > > > > Anyone want to volunteer? Anyone have suggestions on how > > to elect > > > > that person if we get volunteers? > > > > > > > > Along with providing a direction for the group we need > > some people > > > > with any time to spare to volunteer to work with that > > leader and the > > > > rest of the team to add the tests and code necessary to meet the > > > > requirements of the common criteria. > > > > This type of work is really a wonderful chance to learn > > > > Cryptography. It allows you to learn about areas that > > you might not > > > > be familiar with, not to mention being a very valuable > > way for you > > > > to contribute to this team. > > > > > > > > Again welcome new members, > > > > > > > > Ron Teitelbaum > > > > Squeak Cryptography Team Leader > > > > Ron(a)USMedRec.com > > > > > > > > _______________________________________________ > > > > Cryptography mailing list > > > > Cryptography(a)lists.squeakfoundation.org > > > > http://lists.squeakfoundation.org/cgi-bin/mailman/listinfo/cry > > > ptography > > > > > > > > > > > > > >

1 0

re: removing underscores
by Bill Schwab 10 Oct '06

10 Oct '06

Craig, ================================ > I really don't understand.. the argument that they are aesthetically > displeasing. They seem reasonable to me. As I understand it, the underscore character is considered aesthetically displeasing because it's a typewriter hack, intended for underlining things (typing other characters, moving the carriage backward, and overtyping some underscores). It's considered ugly because it's an anachronism, and the subsequent hack of separating tokens in a human's mind within what a machine considers a single token is not sufficient to redeem it (and that the hack of using it for assignment is more worthwhile, mostly because it is displayed as something else). For the sake of good taste and tact I will refrain from divulging my own personal opinion about it. ;) ================================ My intent here is not to start a flame war, but I find the aesthetic line of reasoning to be completely irrelevant. Why should your sense of aesthetics have anything to do with my efficiency? Squeak's objections to underscores are becoming ever more elective. I submit that the "all but first character" fix should have been included in the mainstream years ago. Bill Wilhelm K. Schwab, Ph.D. University of Florida Department of Anesthesiology PO Box 100254 Gainesville, FL 32610-0254 Email: bills(a)anest4.anest.ufl.edu Tel: (352) 846-1285 FAX: (352) 392-7029

1 0

clean-up
by Robert Withers 10 Oct '06

10 Oct '06

I noticed I forgot to inform everyone of the progress I made in reorganizing the RandomAndPrime package. I goofed at first and called it RandomAndSecure, so there are several packages I would like to see Ron delete from the repository. These include all versions of CryptographyBase, Cryptography-Base and Cryptography-RandomAndSecure. Furthermore, with the working Cryptograhy-RandomAndPrime, if you could please include that in the configuration file. While you are at it can you add RC4 and MD5 if those are missing. There were two missing that I can't view right now, since I can't look at configurations. You can also delete the Crypt-Xtra-Config package. Speaking of configurations, why isn't there support to read them in the image? Can you ask the responsible parties to get off their duff and provide us support for them in 3.9? We could really use it. I changed the names of the cipher suites to remove the underscores, if I didn't mention that already. Well I guess that's about all I have. Cheers, Robert

2 3

SqueakMap
by Ron Teitelbaum 10 Oct '06

10 Oct '06

Any know how to release a version to squeakmap for 3.9? Ron

1 0

Monticello Configurations Fix
by Ron Teitelbaum 10 Oct '06

10 Oct '06

Avi, Any chance you could put these changes into Monticello for 3.9? Maybe you could release a 3.9 version with these changes on squeakMap? http://bugs.impara.de/view.php?id=5217 The cryptography group has found configurations to be very beneficial; I'm not sure how people work without them! Thank you for any help you can give us! Ron Teitelbaum

1 0

Welcome New Members and Update
by Ron Teitelbaum 09 Oct '06

09 Oct '06

All, We have a few new members. I would like to welcome you to the list and invite you to introduce yourselves to the list if you feel so inclined and please let us know what your interests in cryptography are, and what you hope to get from this group. We have discussed previously that we might want to build Slang plug in representations of some of our cryptographic primitives to improve performance. There appears to be support for including those primitives internally in the base VM for the different platforms, I would like to take advantage of this opportunity. If anyone has a plug in they would like to have included in the VM maker and then in new VM Builds please submit it to this list for review. (Rob could you enter a mantis bug requesting that we include the DES plug in with future builds of VM’s?). We need the SHA256 plug in written (I have not had time to do it ☹, but I will get to it if nobody volunteers). Are there suggestions for other plug ins that need to be written? Also I would like us to consider looking at the fips common criteria http://niap.bahialab.com/cc-scheme/cc_docs/index.cfm . My feeling is that more testing can not be bad for our cryptography code, and that the more we can accomplish in this area the closer we are to considering getting certified ourselves. It does not make sense to hire a lab until we are satisfied internally that we will pass. Because this is a large process it would be easy to consider this too difficult a task to complete. The major reason to discount this problem is that we have no deadline. This means that with proper organization anyone with some spare time can contribute and move us forward. What we need is someone to help provide this organization. That person needs to be very familiar with the common criteria, should have considerable experience in the cryptography field and should have good organization skills. The job is not complicated and I don’t expect that it should take much time (about 1 hour a month after initial startup). That person would be responsible for developing a short list of tasks that need to be accomplished, would work to help find people to validate work that is already completed, and would tell the community when the work is done. I would suggest that this person would carry the official title of Squeak Cryptography Security Validation Officer. Anyone want to volunteer? Anyone have suggestions on how to elect that person if we get volunteers? Along with providing a direction for the group we need some people with any time to spare to volunteer to work with that leader and the rest of the team to add the tests and code necessary to meet the requirements of the common criteria. This type of work is really a wonderful chance to learn Cryptography. It allows you to learn about areas that you might not be familiar with, not to mention being a very valuable way for you to contribute to this team. Again welcome new members, Ron Teitelbaum Squeak Cryptography Team Leader Ron(a)USMedRec.com

1 0

Removing underscores
by Bill Schwab 06 Oct '06

06 Oct '06

Ron, ================== It would appear that there is a fix for underscores but apparently the community at large does not support them. So although I agree that underscores in methods and class names *SHOULD* be supported, how does the team feel about removing them from our code? ================== Do whatever you think is best. If you want to play along with the group to gain acceptance, so be it. If you want to draw an underscore in the sand, that's ok too (though we might lose the fight), I'll gladly add a voice to the background noise. Squeak certainly should allow underscores in class names and selectors. Your example (TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA) is extreme, but makes the point beyond ANSI and inter-dialect compatibility. The "it will break old code" argument is weak IMHO - old code outside the image has probably broken due to changes anyway, so the compiler errors are most likely just the beginning. Bill Wilhelm K. Schwab, Ph.D. University of Florida Department of Anesthesiology PO Box 100254 Gainesville, FL 32610-0254 Email: bills(a)anest4.anest.ufl.edu Tel: (352) 846-1285 FAX: (352) 392-7029

5 8

Test cases
by Robert Withers 06 Oct '06

06 Oct '06

I was thinking of splitting the Test Case up into multiple test cases that can be run independently. There are a few tests that take a very long time, including the ElGamal test cases and one of the tests for SHA256. I was to create the following test cases: DSATestCase RSATestCase DESTestCase HashFunctionTestCase ElGamalTestCase RijndaelTestCase CipherBlockModeTestCase Then ElGamal can take a long time. Is it ok to remove the SHA256 test case of hashing a 1000000 $a string? The function is already tested with the other two tests. Does anyone have an issue with my doing this? cheers, Robert

3 7

Cryptography-Base
by Robert Withers 06 Oct '06

06 Oct '06

I renamed the CryptographyBase to Cryptography-Base so it fits our naming scheme better. It relies on SHA1 and I suspect other things, so it isn't really a Base. It is more RandomAndPrime. Should I call it Cryptography-RandomAndPrime? Regardless, please stop using CryptographyBase, start using Cryptography-Base and update configurations appropriately. thanks, Robert

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

Cryptography October 2006