October 2002 - cypherpunks-legacy

QuizID?
by Marc Branchaud 17 Oct '02

17 Oct '02

Any thoughts on this device? At first glance, it doesn't seem particularly impressive... http://www.quizid.com/ Lovely idea of two-factor authentication: The user then enters their user name (something they know) and the 8-digit Quizid passcode (something they have) into the login screen of their application. BBC NEWS | Technology | Handy future for online security http://news.bbc.co.uk/1/hi/technology/2334491.stm Excerpt from the BBC article: Users are issued with a card and a personal code, based on a set of colour keys on the card. Each time they wish to conduct a secure transaction, they punch in the colour code and a random number is generated. M. --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com

4 3

Re: XORing bits to eliminate skew
by georgemw＠speakeasy.net 17 Oct '02

17 Oct '02

BTW, if the bits are assumed to be independent of each other and you're only concerned with eliminating skew, there's a well known simple scheme to eliminate it entirely: group the bits into pairs if the pair is 00 or 11 toss it if the pair is 01 map it to zero if the pair is 10 map it to 1 this method gets you a fourfold reduction in the number of bits in the best case. George

1 0

RE: QuizID?
by Trei, Peter 17 Oct '02

17 Oct '02

> Branchaud, Marc writes: > > Any thoughts on this device? At first glance, it doesn't seem > particularly impressive... > > http://www.quizid.com/ > > Lovely idea of two-factor authentication: > > The user then enters their user name (something they know) and the > 8-digit Quizid passcode (something they have) into the login screen > of their application. > > BBC NEWS | Technology | Handy future for online security > http://news.bbc.co.uk/1/hi/technology/2334491.stm > > Excerpt from the BBC article: > > Users are issued with a card and a personal code, based on a set of > colour keys on the card. Each time they wish to conduct a secure > transaction, they punch in the colour code and a random number is > generated. > > M. > [Note of vested interests: I work on RSA SecurID, which is a competing product.] Based on the information at the site, and Quizid's statement that their hardware is manufactured by ActivCard, I have to say that this looks an *awful lot* like the ActivCard Keychain Token, repackaged into a bigger form factor. Peter Trei Disclaimer: The above represents only my personal opinion. --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com

1 0

QuizID
by Adam Shostack 17 Oct '02

17 Oct '02

http://news.bbc.co.uk/2/hi/technology/2334491.stm and www.quizid.com > A credit-card sized device, which could potentially be issued to > thousands of citizens, is being heralded as a major breakthrough in > the search for establishing secure identification on the internet. ... > Users are issued with a card and a personal code, based on a set of > colour keys on the card. Each time they wish to conduct a secure > transaction, they punch in the colour code and a random number is > generated. > The card works in conjunction with the Quizid vault - a large > collection of computers that can process 600 authentications per > second. The system cost millions of pounds to develop. (Oooh! six hundred! Impressive! :) I don't see anything on their site about the technology, but I do question if 4 colored buttons, with a probable pin length of 4-6, is worth 10-70 pounds per year..For that price you can get securid cards, which aren't nearly as pretty, but that's nothing Ideo couldn't fix in a week. Adam -- "It is seldom that liberty of any kind is lost all at once." -Hume

1 0

her cebe bedava kontor y�kleme f�rsat�
by ekgelirler＠yahoo.com 17 Oct '02

17 Oct '02

1 0

Re: One time pads
by Sam Ritchie 17 Oct '02

17 Oct '02

ACTUALLY, quantum computing does more than just halve the effective key length. With classical computing, the resources required to attack a given key grow exponentially with key length. (a 128-bit key has 2^128 possibilities, 129 has 2^129, etc. etc. you all know this...) With quantum computing, however, the complexity of an attack grows only polynomially. Hence a MUCH MUCH more agreeable time frame for brute force attacks. Good stuff, eh? ~SAM > From: "Trei, Peter" <ptrei(a)rsasecurity.com> > Date: Wed, 16 Oct 2002 14:50:03 -0400 > To: David Howe <DaveHowe(a)gmx.co.uk>, "Email List: Cypherpunks" > <cypherpunks(a)lne.com>, "'David E. Weekly'" <david(a)weekly.org> > Subject: RE: One time pads > >> David E. Weekly[SMTP:david@weekly.org] >> >> Naive question here, but what if you made multiple one time pads (XORing >> them all together to get your "true key") and then sent the different pads >> via different mechanisms (one via FedEx, one via secure courier, one via >> your best friend)? Unless *all* were compromised, the combined key would >> still be secure. >> >> As for PKI being secure for 20,000 years, it sure as hell won't be if >> those >> million-qubit prototypes turn out to be worth their salt. Think more like >> 5-10 years. In fact, just about everything except for OTP solutions will >> be >> totally, totally fucked. Which means that you should start thinking about >> using OTP *now* if you have secrets you'd like to keep past when an >> adversary of yours might have access to a quantum computer. I'd put 50 >> years >> as an upper bound on that, 5 years as a lower. >> >> -d >> > Not quite right. My understanding is that quantum > computing can effectively halve the length of a > symmettric key, but that does not take it down to zero. > > Thus, a 256 bit key would, in a QC world, be as secure > as a 128 bit key today, which is to say, pretty good. > > It's the asymmetric algorithms which have problems. > > Peter

2 1

Re: commericial software defined radio (to 30 Mhz, RX only)
by Morlock Elloi 17 Oct '02

17 Oct '02

> Does this run on linux? Also, if regular cheapo PC sounboards can digitize 30 MHz (and Nyquist says this requires 60 MHz sampling rate) then some product managers need ... flogging. ===== end (of original message) Y-a*h*o-o (yes, they scan for this) spam follows: Faith Hill - Exclusive Performances, Videos & More http://faith.yahoo.com

1 0

RE: One time pads and Quantum Computers
by Bill Stewart 16 Oct '02

16 Oct '02

> > David E. Weekly[SMTP:david@weekly.org] > > As for PKI being secure for 20,000 years, it sure as hell won't be if > > those million-qubit prototypes turn out to be worth their salt. > > Think more like 5-10 years. In fact, just about everything except > > for OTP solutions will be totally, totally fucked. At 02:50 PM 10/16/2002 -0400, Trei, Peter wrote: >Not quite right. My understanding is that quantum >computing can effectively halve the length of a >symmettric key, but that does not take it down to zero. >Thus, a 256 bit key would, in a QC world, be as secure >as a 128 bit key today, which is to say, pretty good. >It's the asymmetric algorithms which have problems. Yeah. What we have to do for that is start thinking about ways to apply Kerberos and similar technologies to real-world problems besides the inside-an-organization ones they were originally designed for. > David E. Weekly[SMTP:david@weekly.org] > > Which means that you should start thinking about > > using OTP *now* if you have secrets you'd like to keep past when an > > adversary of yours might have access to a quantum computer. ... OTPs won't help a bit for that problem. They're fine for transmitting new data if you've already sent a pad, but they're useless for storing secrets, because you can only decrypt something if you've got the pad around, and you have to burn the pad after use. Storing the encrypted secret message on your regular computers while keeping the pad locked up in the safe is unlikely to be any more convenient than keeping the plaintext locked up in the safe. I suppose you could secret-share a one-time-pad, but you could just as easily secret-share the secret message.

1 0

Do you hava a problem with Spam?
by Rahmon Bigornia 16 Oct '02

16 Oct '02

1 0

sniping as performance art
by Major Variola (ret) 16 Oct '02

16 Oct '02

> From: "Trei, Peter" <ptrei(a)rsasecurity.com> > I fail to see how anyone, anytime, anywhere, can support > the hunting of random non-consenting humans for sport. Maybe its a PETA activist making a point...

1 0