Cryptography

cryptography@lists.squeakfoundation.org

364 discussions

FIPS 140-2 Certification Inquires
by Ron Teitelbaum 12 Jul '06

12 Jul '06

All, I just wanted to let everyone know that I've started looking into the FIPS 140-2 Certification. I've started the search for a testing lab. My first call is with SAIC to get more information. I chose them primarily because they are local to me. If anyone has suggestions, questions they want answered, or people or other labs they suggest that I contact please let me know. I will keep you updated on our progress. Ron Teitelbaum Squeak Cryptography Team Leader

1 0

block-based cipher padding
by Ron Teitelbaum 11 Jul '06

11 Jul '06

Hi Chris, I've finally figured out what was going wrong with some of my CBC tests. I have some more questions about padding. The test: Case #3: Encrypting 48 bytes (3 blocks) using AES-CBC with 128-bit key Key : 0x6c3ea0477630ce21a2ce334aa746c2cd IV : 0xc782dc4c098c66cbd9cd27d825682c81 Plaintext : This is a 48-byte message (exactly 3 AES blocks) Ciphertext: 0xd0a02b3836451753d493665d33f0e886 2dea54cdb293abc7506939276772f8d5 021c19216bad525c8579695d83ba2684 Is returning the value: 'D0A02B3836451753D493665D33F0E8862DEA54CDB293ABC7506939276772F8D5021C19216BA D525C8579695D83BA2684D248B3E0F2388C137102846EB06272FF' which is correct except for the padding. Since we are using the padding and it will be removed in our system should this be considered a passing test? My guess is yes but if we send these encrypted values to other systems will they know how to un-pad and decrypt the cipherText? In other words, how widely adopted is Schneier's and Ferguson's padding suggestion? Should we enable a switch to allow developers to turn this off? Ron Teitelbaum President / Principal Software Developer US Medical Record Specialists Ron(a)USMedRec.com Squeak Cryptography Team Leader

2 4

IPSec ESP with AES
by Ron Teitelbaum 11 Jul '06

11 Jul '06

Hi All, Has anyone attempted IPSec Encapsulating Security Payload (ESP), it looks like we have most of what is needed to get this to work. I don't want to attempt it if it's already done. Also there is a possibility that this work will require some minor network VM changes for ESP headers (although I'm just getting started so I'm not sure about that), since the tcp packets are handled in primitives. So has anyone written an ESP tcp socket already? And will anyone in the VM or Network Group volunteer to help with VM changes to get this done? Thanks, Ron Teitelbaum President / Principal Software Engineer US Medical Record Specialists Ron(a)USMedRec.com Squeak Cryptography Team Leader

1 0

Re: isProperlyPadded
by Chris Muller 07 Jul '06

07 Jul '06

> Since isProperlyPadded assumes that that was some padding the error > seems > unnecessary. > ... > To make it more clear if a byte array is not padded then the > unpaddedSize is > self size. Hi Ron, I believe the check in #unpaddedSize is proper, let me explain. Any application must know if it is dealing with a block or stream cipher, therefore it knows if padding is necessary. I think you agree with this because you said: > Since isProperlyPadded assumes that that was some padding.. In other words, isProperlyPadded knows nothing about whether a ByteArray *is* padded, you only call it if you KNOW it's supposed to be padded and then it will tell you if it is padded properly. If padding is not necessary (stream cipher), the program should not be asking for the #unpaddedSize at all. If padding is necessary then Nils and Bruce say any improper padding should be treated as an authentication error. If the program asks for the #unpaddedSize for a message that was not properly padded, simply returning "self size" would be erroneous and the program would then be making improper assumptions about the message. Regards, Chris

2 2

FW: isProperlyPadded
by Ron Teitelbaum 07 Jul '06

07 Jul '06

Hit send by accident before I finishing editing! To make it more clear if a byte array is not padded then the unpaddedSize is self size. What do you think? Ron Teitelbaum _____ From: Ron Teitelbaum [mailto:Ron@USMedRec.com] Sent: Thursday, July 06, 2006 11:08 PM To: 'Cryptography Team Development List' Subject: isProperlyPadded Chris, I ran into your padding methods which put the remainder size in each empty space after the real data. I have a problem with ByteArray>>unpaddedSize "If I was padded by a BlockCipher, answer the size of the original plaintext." self isProperlyPadded ifFalse: [ CryptographyError signal: 'Authentication failure (improperly padded!)' ]. ^ self size - self last Since isProperlyPadded assumes that that was some padding the error seems unnecessary. Shouldn't this say: ByteArray>>unpaddedSize "If I was padded by a BlockCipher, answer the size of the original plaintext." self isProperlyPadded ifFalse: [^self size]. ^ self size - self last

1 1

isProperlyPadded
by Ron Teitelbaum 07 Jul '06

07 Jul '06

Chris, I ran into your padding methods which put the remainder size in each empty space after the real data. I have a problem with ByteArray>>unpaddedSize "If I was padded by a BlockCipher, answer the size of the original plaintext." self isProperlyPadded ifFalse: [ CryptographyError signal: 'Authentication failure (improperly padded!)' ]. ^ self size - self last Since isProperlyPadded assumes that that was some padding the error seems unnecessary. Shouldn't this say: ByteArray>>unpaddedSize "If I was padded by a BlockCipher, answer the size of the original plaintext." self isProperlyPadded ifFalse: [^self size]. ^ self size - self last

1 0

Team Update
by Ron Teitelbaum 08 Jun '06

08 Jun '06

All, Well it's amazing how time flies. With the real world demands on time, things progress slowly. Our goals are still the same and can be found on the squeaksource wiki for Cryptography. ( www.squeaksource.com/Cryptography.html ) I had hoped to make more progress then we have but we'll take what we can get. On the ASN.1 front: Our first task was to recommend reading to the group to make sure everyone knew about ASN, its uses and application to cryptography and computer to computer communication in general. We started with http://www.oss.com/asn1/dubuisson.html . If you have other suggested reading about ASN please let us know. As a group we decided that we should start with an ANS.1 implementation so that's where we are now. We contacted Cincom about their ASN.1 implementation. James agreed to let us port the Cincom implementation of ASN.1 to Squeak but would not agree to allow us to re-license it to Squeak-L or MIT. Now that we have made significant progress with the licensing of Squeak in general, when we have a newly licensed Squeak we can go back and ask James again if we can port the code. Paul and I decided to give an implementation a shot in a parallel effort. We are making progress but nothing worth sharing yet. We have set up a new repository for that. We see this a mostly an exercise to learn ANS.1 but still hold the possibility that functional code may be released from this effort. If you would like to know more about what we are doing please let me know. The ASN.1 implementation we are working on uses traits. Paul found that using traits made the implementation go much easier. This is a nice way to get to know the new trait system for more information on traits see: http://www.iam.unibe.ch/~scg/Research/Traits/ We also recently discussed some issues regarding protecting the image and the VM, using signed updates to distribute code, and getting our implementations certified. So far no progress has been made on those fronts but if anyone would like to step up and lead an effort in that those areas, or if you have suggestions on other things we should be working on please feel free to let us know. On the legal front we have notified the US Government about our work, so as long as a US Citizen does not physically export code to a "Terrorist Country" (meaning take the code copy it to a CD or other format and send it, or directly email the code to someone in a terrorist country or something like that) we are protected from export restrictions. We have not done any work on export restrictions from other countries so if you live in another country and have concerns about legal restrictions you are not protected from this notification and should research issues in your country before contributing to this effort. Also let me know and I see what I can do to help. If anyone has an update they would like to give about your efforts please feel free to let us know what you are doing. Thanks, Ron Teitelbaum Cryptography Team Leader

2 2

Self-introduction
by Frank Shearar 08 Jun '06

08 Jun '06

Hi everyone, Since this is my first post to the crypto list, I thought I'd introduce myself. * I've been playing with Squeak (as in programming outside work) for a few years now, and have a couple unfinished projects under my belt (*). * I've been programming for a living for nearly ten years now, almost entirely in Delphi, but with a smattering of REXX and the usual suspects (C++, Java, C#). * I've been interested in crypto for a few years now, primarily from a number theory point of view, but also from a practical point of view (that is, as someone desiring strong encryption/authentication/etc.). I'm an avid reader of Bruce Schneier's work, owning copies of most of his books, and following his blog. Hopefully I can contribute something to this very important work! frank (*) The thing of which I'm most proud, and is closest to completion, is my Image Map Editor project on SqueakSource. It's stalled because of lack of time, but I eventually intend rewriting the GUI to fit Tweak). And then there's my SIP stack, also stalled for lack of time. It doesn't help that most of my day is spent working on a SIP stack (http://www.ictrnid.org.uk/index.html?softlib.html).

2 1

Associate Research Fellow in Cryptography - 3 years appointment - UoW Australia
by Willy Susilo 03 Jun '06

03 Jun '06

*associate research fellow - cryptography*** *Faculty of Informatics* · *Fixed Term (3 years), Full-time position* UOWs Centre for Information Security, which is a part of the Faculty of Informatics, is seeking to appoint a suitably qualified individual to work on the ARC Discovery project entitled: //'Credential Systems and Their Applications in Securing Electronic Health Records'//. To be successful, you will possess a PhD in Cryptography / Mathematics or equivalent area and demonstrate your experience in Cryptography and its applications. Ideally, you will also have developed credential based crypto-systems and its applications to electronic health records. You must address the Selection Criteria specified in the Position Description, which is available from our website. For further information about this role, please contact Assoc Prof Willy Susilo on + 61 2 4221 5535. Appointment is based on merit. As women are under-represented in academic positions, suitably qualified women are encouraged to apply. /Previous applicants need not apply./ */ /* *Applications Close 2 July 2006 Quote Ref No: 21478* *How to Apply: Please go to our website *http://employment.uow.edu.au/ *to submit your application online & for more information about the position and UOW.* * *

1 0

loading crypto packages
by Chris Muller 10 May '06

10 May '06

To load cryptography packages from SqueakSource, first load Cryptography-Core, then SHA1, then CryptographyBase. - Chris

1 0

← Newer
1
...
28
29
30
31
32
33
34
...
37
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

Cryptography