Cryptography November 2006

cryptography@lists.squeakfoundation.org

8 participants
23 discussions

Re: [Cryptography Team] [ENH] AES
by Cerebus 25 Nov '06

25 Nov '06

On 11/24/06, cerebus2(a)gmail.com <cerebus2(a)gmail.com> wrote: > It struck me as convenient to have an AES class. All I did was subclass > Rijndael and override new with the relevant block size and key size. I > have no idea if this is sufficient, but I suppose it's a start. Now I > need to figure out how to write tests. Just to let everyone know, I *really* don't have any idea what I'm doing. :) Background: I don't write code in my day job, and it's been many years since I've seriously coded at all beyond scripting for my own convenience. Currently I'm working for an FFRDC supporting a government PKI, so I've been steeped more in the policy end and riding herd on vendors (like Cisco, though I don't think I've ever met Krishna before) for the last 10 years, with a dash of sysadmin and testing thrown into the mix. My knowledge of crypto doesn't extend far beyond using the primitives to construct protocols & systems. I don't get the math, I may never get the math, but in the end it may not matter. My interest in Squeak runs back a bunch of years, but I never did more than toy with it. What's changed recently was I got a chance to sit in on a demonstration by a couple of guys from MIT Lincoln Labs who are doing interesting things with Boneh/Waters/Gentry broadcast encryption on a contract. Their system requires ECC and I thought it would be interesting to model their prototype, which led me back to Squeak, which led me to this project. -- Tim

2 1

ECC and/or NSA Suite B?
by Cerebus 25 Nov '06

25 Nov '06

Is anyone working on Suite B stuff? Rijndael is there, but it probably should be subclassed as AES proper if only to lock down the blocksize to 128 bits and the keysize to the allowed 128 & 256 bits. SHA256 is there, but it doesn't extent to cover the rest of the SHA2 family (SHA384 and SHA512). SHA384 is part of Suite B. Is anyone working on ECDSA, ECDH & ECMQV? (Well, given that ECMQV is more heavily patent-encumbered in the US, I can understand if it's left by the wayside). If not I might take a crack at a couple of pieces. -- Tim

4 19

RE: [Cryptography Team] [FIX] Crypto changes
by Ron Teitelbaum 24 Nov '06

24 Nov '06

Thank you I posted and released your change. We still need to review our validation of e=3 signatures. Did you have a look at that? Is there any way that reading ASN.1 would stop and leave more data past the hash without throwing an error? Ron > -----Original Message----- > From: cryptography-bounces(a)lists.squeakfoundation.org > [mailto:cryptography-bounces@lists.squeakfoundation.org] On Behalf Of > cerebus2(a)gmail.com > Sent: None > To: cryptography(a)lists.squeakfoundation.org > Subject: [Cryptography Team] [FIX] Crypto changes > > from preamble: > > "Change Set: Crypto changes > Date: 23 November 2006 > Author: Timothy J. Miller > > Changed e to 65537."!

2 4

[ENH] AES
by cerebus2＠gmail.com 24 Nov '06

24 Nov '06

from preamble: "Change Set: AES Date: 24 November 2006 Author: Timothy J. Miller It struck me as convenient to have an AES class. All I did was subclass Rijndael and override new with the relevant block size and key size. I have no idea if this is sufficient, but I suppose it's a start. Now I need to figure out how to write tests."!

1 0

RE: Re: [Cryptography Team] ECC and/or NSA Suite B?
by Ron Teitelbaum 24 Nov '06

24 Nov '06

Hi Krishna! I agree with you both! This team should be fun. What we are doing is very interesting and very rewarding. Thank you everyone for your time! Happy holidays to everyone from my family too! Ron > -----Original Message----- > From: cryptography-bounces(a)lists.squeakfoundation.org > [mailto:cryptography-bounces@lists.squeakfoundation.org] On Behalf Of > Krishna Sankar > Sent: Friday, November 24, 2006 3:09 PM > To: 'Cryptography Team Development List' > Subject: RE: Re: [Cryptography Team] ECC and/or NSA Suite B? > > You wrote : > > > > 1) I love crypto, and building an ECC implementation would > > teach me a great deal about it; > > > > 2) It gives me a reason to learn Smalltalk, something I've > > toyed with a dozen times in the past but never made progress > > at because I had nothing concrete to work on; and > > > > 3) It would just be fun. I'm weird that way. > > > > But the last thing I want to do is run afoul of Certicom (or > > cause others to run afoul of them). > > > > So, advice? Should I press ahead? > <KS> > Same reason for me to get involved as well ! Interest in crypto as > well as a good reason to work on Smalltalk. > > Just as a POV, it is Ok to develop ECC. It gives us a leg up for our > cryptography portfolio. Naturally we would need to figure out the legal > issues before making it part of the system; but we would need to do that > anyway. So your efforts (if you choose to do so ;o)) will not be wasted. > > I have been looking at the SHA code towards developing the SHA512 > and would welcome you help. We can learn collaboratively ! I was waiting > for > the holidays to be over before starting in earnest. > </KS> > > Cheers & happy holidays (Just came back from a grueling Black Friday > shopping (er .. carrying bags for the better half ...) > <k/> > > _______________________________________________ > Cryptography mailing list > Cryptography(a)lists.squeakfoundation.org > http://lists.squeakfoundation.org/cgi-bin/mailman/listinfo/cryptography

1 0

RE: [Cryptography Team] ECC and/or NSA Suite B?
by Ron Teitelbaum 24 Nov '06

24 Nov '06

Forgot the link: http://www.sun.com/emrkt/innercircle/newsletter/0304cto.html Ron > -----Original Message----- > From: Ron Teitelbaum [mailto:Ron@USMedRec.com] > Sent: Friday, November 24, 2006 2:25 PM > To: 'Cryptography Team Development List' > Subject: RE: [Cryptography Team] ECC and/or NSA Suite B? > > I'm not sure I understand this since SUN released ECC to the public > domain. I'll get an opinion on it: > > > -----Original Message----- > > From: cryptography-bounces(a)lists.squeakfoundation.org > > [mailto:cryptography-bounces@lists.squeakfoundation.org] On Behalf Of > > Matthew S. Hamrick > > Sent: Friday, November 24, 2006 2:07 PM > > To: Cryptography Team Development List > > Subject: Re: [Cryptography Team] ECC and/or NSA Suite B? > > > > Keep in mind, however, that products violate patent restrictions, not > > implementations. Otherwise OpenSSL would not be able to include IDEA, > > MDC2 or RC5. > > > > With all the discussion of FIPS 140, I had assumed that most everyone > > on the list is working on government contracts. Otherwise, why bother > > with it? > > > > The NSA negotiated a blanket US Federal Government deal for > > Certicom's patent portfolio for use in ECDSA, ECDH and ECMQV. So... > > if you're a federal government agency, you get to use these > > algorithms without having to pay Certicom anything extra. So... if > > part of what you're hoping to do is to create an ECC implementation > > that can be used by a federal agency, then you can do so without fear > > of the Certicom lawyers. Now... the moment the implementation gets > > used in a commercial product, then you've got issues. > > > > On Nov 23, 2006, at 10:24 PM, Cerebus wrote: > > > > > Is anyone working on Suite B stuff? > > > > > > Rijndael is there, but it probably should be subclassed as AES proper > > > if only to lock down the blocksize to 128 bits and the keysize to the > > > allowed 128 & 256 bits. > > > > > > SHA256 is there, but it doesn't extent to cover the rest of the SHA2 > > > family (SHA384 and SHA512). SHA384 is part of Suite B. > > > > > > Is anyone working on ECDSA, ECDH & ECMQV? (Well, given that ECMQV is > > > more heavily patent-encumbered in the US, I can understand if it's > > > left by the wayside). > > > > > > If not I might take a crack at a couple of pieces. > > > > > > -- Tim > > > _______________________________________________ > > > Cryptography mailing list > > > Cryptography(a)lists.squeakfoundation.org > > > http://lists.squeakfoundation.org/cgi-bin/mailman/listinfo/ > > > cryptography > > > > _______________________________________________ > > Cryptography mailing list > > Cryptography(a)lists.squeakfoundation.org > > http://lists.squeakfoundation.org/cgi-bin/mailman/listinfo/cryptography

3 6

CC and Squeak.
by Cerebus 24 Nov '06

24 Nov '06

I was poking through the list archives and I notice a large amount of traffic relating to CC certification. All the CC OS PPs require--at a minimum--implementation of discretionary access control over user actions. As Squeak has no concept of users or access control at all, I don't think any CC certification is a realistic goal. In fact, as Squeak is a live system, I don't think access control is implementable without rewriting the VM from scratch; and the result wouldn't be anything like the Squeak you know and love. For that matter, the live nature of the Squeak image will make FIPS certification problematic. FIPS certification requires strict version control over the crypto code. While subclassing a FIPS certified crypto class would be OK, overloading a FIPS method could invalidate the certification (unless it calls super for the certified sections). Extending a FIPS certified class would be a similar problem. Other crypto libraries have similar issues, but compiled code can generally show that they are using a fixed API and are linked to a certified version. A live system such as Squeak faces unique challenges. Every application built on an ostensibly FIPS-certified Squeak crypto library would have to be examined to ensure that FIPS code is not being overloaded, and even then you can't be sure that the final system isn't being modified by the end user... -- Tim

3 2

Re: [Cryptography Team] [FIX] Crypto changes
by Cerebus 24 Nov '06

24 Nov '06

Hey, it worked! I'm so proud of myself. :) -- Tim On 11/23/06, cerebus2(a)gmail.com <cerebus2(a)gmail.com> wrote: > from preamble: > > "Change Set: Crypto changes > Date: 23 November 2006 > Author: Timothy J. Miller > > Changed e to 65537."! > > > _______________________________________________ > Cryptography mailing list > Cryptography(a)lists.squeakfoundation.org > http://lists.squeakfoundation.org/cgi-bin/mailman/listinfo/cryptography > > > >

1 0

[FIX] Crypto changes
by cerebus2＠gmail.com 24 Nov '06

24 Nov '06

from preamble: "Change Set: Crypto changes Date: 23 November 2006 Author: Timothy J. Miller Changed e to 65537."!

1 0

Weak value of e in RSAKeyPairGenerator
by Cerebus 22 Nov '06

22 Nov '06

I've just started playing around with the crypto code (and Squeak in general), but I noticed that RSAKeyPairGenerator is using a weak value for e (e=3). This is contrary to recommendations after the revelation at Crypto 2006 by Daniel Bleichenbacher of an attack against some implementations of PKCS#1 v1.5 signatures: http://csrc.nist.gov/news-highlights/RSA-statement_10-17-06_.pdf I've looked at RSAKey>>v15VerifySignature:ofMessageHash: and it doesn't seem (to me) to be vulnerable to this specific attack (as it explicitly uses readStream>>upToEnd:). However, the attack also hinges on the finding eth roots, when when e=3 is pretty easy. Using an e>3 gives added insurance against this finding. Interestingly, the DoD PKI has been using e=65537 from the very beginning. I changed e to 65537 and all seems well. I'd post a patch, but at this point I have no idea how to extract one. -- Tim

3 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

Cryptography November 2006