Cryptography October 2006

cryptography@lists.squeakfoundation.org

13 participants
38 discussions

Cryptographic Primitives
by Ron Teitelbaum 05 Oct '06

05 Oct '06

All, We are considering adding a few more Cryptographic Primitives. We have had problems with having to support the primitives externally. We believe that the community would benefit from lowering the cost of entry to cryptographic functionality. The Cryptographic primitives are very small, but benefit greatly from primitive implementations because of the intensive math calculations. I would like to ask the community to include the DES code and new primitives that we are considering internally in the base distributed VM's so that they are available for everyone. Since the code is so small could we consider including it internally? Thank you for your consideration, Ron Teitelbaum Squeak Cryptography Team Leader

2 2

Removing underscores
by Ron Teitelbaum 05 Oct '06

05 Oct '06

All, It would appear that there is a fix for underscores but apparently the community at large does not support them. So although I agree that underscores in methods and class names *SHOULD* be supported, how does the team feel about removing them from our code? Ron Teitelbaum -----Original Message----- From: Bert Freudenberg [mailto:bert@freudenbergs.de] Sent: Thursday, October 05, 2006 6:41 AM To: Ron(a)USMedRec.com Subject: Re: [Cryptography Team] New Members Well, it's a simple hack in the parser to make $_ be accepted in identifiers. However, it's not valid Squeak syntax and breaks backwards-compatibility, besides being ugly as hell ;) It's been discussed many times, like here: http://lists.squeakfoundation.org/pipermail/squeak-dev/2000-May/003374.html What Parser/Compiler are you using? I know Croquet does not accept any underscores, not even as assignment. - Bert - Am 05.10.2006 um 01:19 schrieb Ron Teitelbaum: > It works fine in my system. I have no problem with it. The name comes > directly from the protocol spec. If you look closely at it defines > the > spec. I suppose that TlsDheDssWith3DesEdeCbcSha would be ok but > it's really > hard to read, I like TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA much better. > Especially since there is TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA and > TLS_DHE_DSS_WITH_3DES_CBC_SHA etc.. This and underscores in > selectors really > needs to work. Any idea why it works on my system and not on others? > > Ron > >> -----Original Message----- >> From: Bert Freudenberg [mailto:bert@freudenbergs.de] >> Sent: Wednesday, October 04, 2006 5:15 PM >> To: Ron(a)USMedRec.com >> Subject: Re: [Cryptography Team] New Members >> >>> SSLCipherSuite subclass: #TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA >> >> This is no valid identifier - where does a class with underscores in >> its name come from?! >> >> - Bert - >> >> Am 04.10.2006 um 21:57 schrieb Ron Teitelbaum: >> >>> Hi Bert, >>> >>> There have been a number of people that have mentioned problems with >>> underscores in selectors and in this email in class names. I >>> know you >>> worked on these problems. Do you know why this would be failing on >>> Max OS >>> X? (I don't seem to have any problems winXp - 3.9[7051] but I may >>> have >>> loaded some code to fix it in the past) >>> >>> Thanks Bert, >>> >>> Ron >>> >>> -----Original Message----- >>> From: cryptography-bounces(a)lists.squeakfoundation.org >>> [mailto:cryptography-bounces@lists.squeakfoundation.org] On Behalf >>> Of Steven >>> Elkins >>> Sent: Wednesday, October 04, 2006 3:39 PM >>> To: Cryptography Team Development List >>> Subject: Re: [Cryptography Team] New Members >>> >>> On 10/3/06, Ron Teitelbaum <Ron(a)usmedrec.com> wrote: >>> >>>> I see we have a few new members. If you feel so inclined please >>>> introduce >>>> yourself and let the team know what areas you are interested in. >>>> This >>> team >>>> is small so we try to encourage as much participation as possible. >>> >>> Hi Ron, >>> >>> First, thanks to you and the other members of the Cryptography team. >>> >>> I'm interested in the pure Smalltalk solution first, just because I >>> think it's the path of least resistance. Maybe I'm wrong. :) I >>> found a load order in another cryptography list message, downloaded >>> the latest version of everything from SqueakSource, and started >>> loading them from a FileList. >>> >>> Cryptography-Core-rww.17.mcz >>> leaves CryptographyError in Undeclared >>> Cryptography-SHA1-rww.8.mcz >>> Cryptography-MD5-cmm.2.mcz >>> Cryptography-DES-hmm.3.mcz >>> leaves interpreterProxy in Undeclared >>> Cryptography-SHA256-RJT.5.mczCryptographyBase-hmm.18.mcz >>> defines CrytographyError >>> Cryptography-ElGamal-cmm.3.mcz >>> Cryptography-RSA-rww.5.mcz >>> Cryptography-Rijndael-RJT.7.mcz >>> Cryptography-ASN1-RJT.17.mcz >>> Cryptography-RC4-rww.3.mcz >>> Cryptography-DSA-rww.3.mcz >>> Cryptography-X509-rww.21.mcz >>> Cryptography-SSL-rww.93.mcz >>> >>> SSLCipherSuite subclass: #TLSNothing more expected >>> ->_DHE_DSS_WITH_3DES_EDE_CBC_SHA >>> instanceVariableNames: '' >>> classVariableNames: '' >>> poolDictionaries: '' >>> >>> Probably the underscores. :) I was using an untouched 3.9g-7061 on >>> Mac OS X when I saw this. Should I use another image? Change some >>> preferences? File something else in first? Read every bit of the >>> cryptography list archives? Load in some other way? >>> >>> Load in some other way. I restarted the same image and installed >>> Cryptography 0.3 from SqueakMap. No underscore problem but it still >>> leaves #interpreterProxy in Undeclared. Selected Cryptography-ASN1 >>> and Cryptography-Tests in the Test Runner. Errors. Loaded... >>> >>> Cryptography-DES-hmm.3.mcz >>> >>> ...and all but 2 of 23 passed, an assertion failure in >>> CryptoTest>>testDSASigningAndVerifying and an error, >>> MessageNotUnderstood (#unsignedLongAt:bigEndian) in the send chain >>> that starts with encryptBlock: in CryptoTest>>testDES2. >>> >>> I'll be happy to provide more information if you want, load other >>> versions of whatever, or perform other experiments, time >>> permitting of >>> course. >>> >>> Keep up the good work, >>> Steve >>> >>> >>> -- >>> How wonderful it is that nobody need wait a single moment >>> before starting to improve the world. -- Anne Frank >>> Paradise is exactly where you are >>> right now...only much, much better. -- Laurie Anderson >>> _______________________________________________ >>> Cryptography mailing list >>> Cryptography(a)lists.squeakfoundation.org >>> http://lists.squeakfoundation.org/cgi-bin/mailman/listinfo/ >>> cryptography >>> >> >> >

1 0

New Members
by Ron Teitelbaum 05 Oct '06

05 Oct '06

New Team Members, I see we have a few new members. If you feel so inclined please introduce yourself and let the team know what areas you are interested in. This team is small so we try to encourage as much participation as possible. Welcome, Ron Teitelbaum

4 10

New Members
by Bill Schwab 04 Oct '06

04 Oct '06

Ron, =================================== I'm hoping that this is not the case, the UI for me is still in flux but I'm still very happy with seaside. Have a look at www.dabbledb.com which is written entirely in seaside. With the live update pieces I've seen (seasideAsync) which allows for portions of the page to be updated without reloading the whole page, it is really snappy! =================================== That is impressive. I try to keep my machines ignorant of flash (too many ads) but I will seek out one that is so configured to view the screencast. Still, it will take some convincing to get me to go completely over to web front ends for everything. ================================================ [underscores] Yes and it worked fine but broke for Rob. I must have loaded the patch you are talking about previously, or I saw the problem and fixed it myself and it's in my own code. I need to find it. ================================================ The patch I have appears below. ================================================= It would apply to all DLL's so communication in and out should be encrypted which doesn't work well if you want plain text sent back into the image. The image itself is safer since the memory is protected, although it's not much more protection since debugging tools can still be used to dump the memory. Bruce Schneier has a lot of suggestions about handling internal memory that I would like to add into Squeak. ================================================= Could we do static linking to the VM? Of course, that would make increase the size of the VM and complicate installing updates to OpenSSL. ================================================= Yes they had the certification but other for profit companies have been fighting against it. They had something but it was revoked. I went to find the status and it looks like they are still on track: ================================================= Got it - thanks. Bill 'From Squeak3.2 of 15 January 2002 [latest update: #4881] on 17 October 2002 at 2:30:42 pm'! "Change Set: underscoreMadness Date: 17 October 2002 Author: Ian Piumarta Makes the Scanner accept underscores in words or keywords (but not in the first position since that would require context sensitivity). Use of this changeset has been officially condemned by the Independent Board of Syntactical Aesthetics for Squeak."! !Scanner methodsFor: 'multi-character scans' stamp: 'ikp 10/17/2002 14:24'! xLetter "Form a word or keyword." | type | buffer reset. [(type _ typeTable at: hereChar asciiValue) == #xLetter or: [type == #xDigit or: [type == #leftArrow]]] whileTrue: ["open code step for speed" buffer nextPut: hereChar. hereChar _ aheadChar. source atEnd ifTrue: [aheadChar _ 30 asCharacter "doit"] ifFalse: [aheadChar _ source next]]. (type == #colon or: [type == #xColon and: [aheadChar ~= $=]]) ifTrue: [buffer nextPut: self step. ["Allow any number of embedded colons in literal symbols" (typeTable at: hereChar asciiValue) == #xColon] whileTrue: [buffer nextPut: self step]. tokenType _ #keyword] ifFalse: [tokenType _ #word]. token _ buffer contents! ! Wilhelm K. Schwab, Ph.D. University of Florida Department of Anesthesiology PO Box 100254 Gainesville, FL 32610-0254 Email: bills(a)anest4.anest.ufl.edu Tel: (352) 846-1285 FAX: (352) 392-7029

1 0

another mnu
by Steven Elkins 04 Oct '06

04 Oct '06

Ran into this saving the image... MessageNotUnderstood: LargePositiveInteger>>destroy 4 October 2006 4:16:17 pm VM: unix - a SmalltalkImage Image: Squeak3.9gamma [latest update: #7061] SecurityManager state: Restricted: false FileAccess: true SocketAccess: true Working Dir /Users/sge/squeak/Squeak3.9g-7061 Trusted Dir /Users/sge/squeak/Squeak3.9g-7061/secure Untrusted Dir /Users/sge/squeak/Squeak3.9g-7061/My Squeak LargePositiveInteger(Object)>>doesNotUnderstand: #destroy Receiver: 954869298867316294434212931469783113123124492707200395373267336674944353477658623170192001...etc... Arguments and temporary variables: aMessage: destroy Receiver's instance variables: 954869298867316294434212931469783113123124492707200395373267336674944353477658623170192001...etc... SecureRandom>>destroy Receiver: a SecureRandom Arguments and temporary variables: Receiver's instance variables: seed: 1369035390015187928040555654137399981674798064385 key: 95486929886731629443421293146978311312312449270720039537326733667494435347...etc... SecureRandom class>>shutDown Receiver: SecureRandom Arguments and temporary variables: Receiver's instance variables: superclass: Stream methodDict: a MethodDictionary(#destroy->a CompiledMethod (3383) #key:->a Compi...etc... format: 134 instanceVariables: #('seed' 'key') organization: ('initialization' destroy key:) ('accessing' next next:into: next...etc... subclasses: nil name: #SecureRandom classPool: a Dictionary(#Picker->a SecureRandom ) sharedPools: nil environment: a SystemDictionary(lots of globals) category: #'CryptographyBase-Support' traitComposition: nil localSelectors: nil etc. So for now I hacked SecureRandom>>destroy :) destroy "key destroy." key _ 0. seed _ 0 -- How wonderful it is that nobody need wait a single moment before starting to improve the world. -- Anne Frank Paradise is exactly where you are right now...only much, much better. -- Laurie Anderson

1 0

New Members
by Bill Schwab 04 Oct '06

04 Oct '06

Ron, ================================ It's nice to talk to you again. ================================ Ditto! ================================ I agree there is much to be done. I've been working with interfaces. I'm working with wxWidgets (wxSqueak) which I think is very nice. I'm also looking at strongtalk but obviously that's further out. What I think I like the most right now is Seaside. I'm seriously considering using web browsers for everything. ================================ Browsers are great for many things, and Seaside is a fascinating technology. However, I still think that some things are a poor fit to a browser. My recordkeeper (Dolphin based) runs quite nicely on 500MHz Celerons with win2k. The user interface is fairly dynamic/data driven, and there were places where I had to move away from native widgets to boost the speed. The native stuff is great for dialog boxes, but it falls short when displaying hundreds of active cells, etc. I have not yet tried similar things in Morphic. I can either map my widgets onto morphs, or if I did something truly unique (which I doubt), I could create a morph that becomes the parent to the widgets in question. ================================ Also I'm not having the same problems with sockets. What problems are you having? Protocol size headers Tag Size Value works pretty well to allow you to handle socket issues. ================================== I have not gotten far enough to have problems (my fault more than Squeak's [*]). However, there have been multiple passes at socket streams, and various cautions and warnings that make me suspicious there is room for improvement. [*] actually, the real fault is Dolphin's, in the sense that it has done everything I have asked of it, to the point that I have had difficulty justifying doing tests with Squeak. FWIW, absense of SSL support was a factor in at least one of the missed opportunities. =============================================== I agree with this and I really need to spend some time on this. When Rob and I were working on SSL we had problems with underscores. What's odd is that I've been using underscores frequently and have had no problems at all with 3.9. At some point I need to figure out why it works for me and fails for others. =============================================== Do you use underscores in selectors? In my tests, it has not yet worked. There has long been a patch to allow underscores everywhere except the first character of a selector (I could live with that), but the community has refused to fold it into the mainstream release. I really don't get it. Elsewhere in the image, the underscore situation has improved dramatically. At least some of the selector hangup is probably related to problems that arose with the underscore fix code. Hopefully that will happen, and the special status of $_ will be removed. I have no objection to a single key shortcut for assignment, but I have always maintained that it should be an optional feature of the editor, not a hack in the compiler and sources. =============================================== Here are my thoughts on the issue. I would like to support OpenSSL but there have been some concerns raised about how to secure the interface between squeak and the openSSL libs. =============================================== Is that unique to OpenSSL, or would the same apply to any DLL? This is probably a sign that I have more archive reading to do - which is indeed the case. =============================================== Also it was much more an attractive proposition when OpenSSL was FIPS certified. The fact that Microsoft's CryptoAPI is FIPS certified makes it an attractive option. It has been mentioned here that if we follow the common criteria that the benefit to FIPS certification diminishes some. I would really like to focus on standard tests for native squeak cryptography. The problem is I don't have much time right now to do it myself. We need help! =============================================== To clarify, are you saying that OpenSSL lost its certification? My understanding is that it was certified in January or thereabouts. Hopefully that has not been reversed. =============================================== As for my own projects, we just filed our patents. We are looking for funding, and I expect that our products are at least a year out. Hopefully once we have a working prototype you will consider helping us with Anesthesiology Medical Records. Nice to hear from you Bill! =============================================== Good luck with your efforts. We would have to learn more about what you want to do and how, but I know a little about anesthesia records<g> and might indeed be interested. Beyond intraoperative records, we can help with ICU flow sheets, H&P, billing, etc.. Please keep us in mind. Bill Wilhelm K. Schwab, Ph.D. University of Florida Department of Anesthesiology PO Box 100254 Gainesville, FL 32610-0254 Email: bills(a)anest4.anest.ufl.edu Tel: (352) 846-1285 FAX: (352) 392-7029

2 1

Re: [Cryptography Team] New Members
by Bill Schwab 04 Oct '06

04 Oct '06

Ron, =============================== New Team Members, I see we have a few new members. If you feel so inclined please introduce yourself and let the team know what areas you are interested in. This team is small so we try to encourage as much participation as possible. Welcome, =============================== My interest in Squeak can be summarized in a few words: open, portable, Smalltalk. I have long believed that I will eventually need to leave Windows, and want an escape valve (which must of course involve Smalltalk); for now, I am not in a hurry. Having time on my side, Squeak might be worth some work and some waiting. So what is missing from or wrong with Squeak? Good access to SSL is critical to many uses I envision, and this group will hopefully fill that void. I also have some reservations about the user interface, and suspect that you (Ron) will share at least some of them due to your focus on medical software. It would be nice to see some cleanup/consistency in socket streams. I am also convinced that Dolphin and VW are correct to signal errors on stream exhaustion, and would like to see Squeak do the same. A fix for underscore snags would be helpful (more below). I realize that the focus here is on cryptography, and moving that forward would be worth the price of admission; it would be better still to find some like-minded Squeakers who can push for some other changes that IMHO would be very good for Squeak. Re Squeak's GUI, the look of the interface is not a big deal to me, nor are native widgets, but the current feel is a problem. Clerks enter data that can be _very_ valuable, and they type; lists grabbing focus on mouse-over would be complete deal-breaker. Tabbing between fields is essential for them to accept software. Modal dialogs are essential to keep the majority of my users out of trouble. Fixing the problems is not necessarily very difficult; my concern is that once I fix them, I am on my own unless the required changes are accepted into the base GUI, if only as options. Re underscores, the main reason I care about them is interfacing with relational databases. I am not a big user of RDBs. However, when the goal is to find Robert Smith among hundreds of thousands or more of his peers, an RDB is the tool of choice. Field names tend to contain underscores, and field names become natural choices for selectors in proxies (if only via DNU). The recent unicode changes have at least gotten rid of the errant back arrows in file names, etc. That's progress, but I keep hoping for more. Back to cryptography, (FWIW) I would prioritize OpenSSL over Microsoft libraries. Things implemented in Squeak would be nice too, but I have had good experience with OpenSSL. My hunch (I could be wrong) is that C/C++ binaries are preferred for cryptographic number crunching, at least for the grunt work of processing incoming and outgoing data streams. For the occasional public key operation, Smalltalk's ability to handle large integers is hard to ignore, and performed reasonably (even surprisingly) well the last time I gave it a try. Bill Wilhelm K. Schwab, Ph.D. University of Florida Department of Anesthesiology PO Box 100254 Gainesville, FL 32610-0254 Email: bills(a)anest4.anest.ufl.edu Tel: (352) 846-1285 FAX: (352) 392-7029

2 1

[ANN] Working SSL In Squeak
by Ron Teitelbaum 02 Oct '06

02 Oct '06

All, A while back I started an implementation of TLS 1.2. Rob Withers joined the effort a few weeks ago and is has made terrific progress. He reorganized everything, added a proper protocol stack, and now has the certificates working. Our version now works with SSL3.0 and TLS 1.1, and DH or RSA using x509v3 Certificates. There are still a number of things that need to be done but we can now use squeak to connect as an SSL server and/or client. See the examples in the workspace that opens when you load the code. You will find our implementation at www.squeaksource.com/Cryptography. There are two Monticello Configuration files available to make loading easier. Load Cryptography-Configuration.mcm, and then Crypt-Xtra-Config.mcm. We could use some help with testing, code review, documentation or any other help you would like to offer. There is also support for MS CryptoAPI and CertificateStores for Microsoft in the MSCert package. In the future I will be working on integrating this functionality. I will also be adding support for KomHttp which is mostly completed but needs to be updated to support Rob's new version. We hope you find this useful and will keep us updated on your use and issues with our implementation. If you have any questions please let us know. Also again we would like to invite anyone with interest or experience with cryptography to join our Cryptography Team at http://lists.squeakfoundation.org/mailman/listinfo/cryptography . Thanks and enjoy, Ron Teitelbaum President / Principal Software Engineer US Medical Record Specialists www.USMedRec.com <http://www.usmedrec.com/> Ron(a)USMedRec.com Squeak Cryptography Team Leader

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

Cryptography October 2006