March 2006 - cypherpunks-legacy

Fwd: [p2p-hackers] lockstep synchronization protocol problem
by coderman 28 Mar '06

28 Mar '06

---------- Forwarded message ---------- From: UE=x <jinz(a)mail.ustc.edu.cn> Date: Mar 28, 2006 2:00 AM Subject: Re: [p2p-hackers] lockstep synchronization protocol problem To: coderman(a)gmail.com can you introduce some papers to read about what you have said?I can't get your meaning,but thank you.how is it related to the synchronization problem? i am about to go offline for the night; here are a few off the top of my head that are relevant. i can post more later this week and others on this list will likely have input. group key distribution: Efficient Self-Healing Group Key Distribution with Revocation Capability (2003) http://citeseer.ist.psu.edu/623802.html group reputation / trust metrics: www.levien.com/thesis/compact.pdf quorums and usability are more complicated and i don't have any links off hand. best regards, P.S. please reply with any additional research / results if you encounter them... TZDz5D@4PEVPTx>-La5=: >From: coderman <coderman(a)gmail.com> >Reply-To: >To: "UE=x" <jinz(a)mail.ustc.edu.cn>, "Peer-to-peer development." <p2p-hackers(a)zgp.org> >Subject: Re: [p2p-hackers] lockstep synchronization protocol problem >Date:Tue, 28 Mar 2006 01:49:17 -0800 > >On 3/28/06, UE=x <jinz(a)mail.ustc.edu.cn> wrote: >> I'm doing research about synchronization problem in P2P system,and the basic >> synchronization protocol is the lockstep protocol,and it use rounds to synchronize >> all the peer's movements,the problem is lockstep only synchronize peer's >> movements?what about the event created by all the peers?can it use rounds to >> synchronize them?and how to ? > >look at using a quorum based key distribution and agreement protocol >(where quorum == a specific subset of group key management) with >regular attestation / rekeying via trusted and strongly authenticated >mechanisms. session timeout (for failure / lack of consensus / >malicious attack) should be detected within an appropriate time frame >for the user to respond securely. (i tend to think 60 seconds is an >acceptable window) > >doing this in a user friendly manner is very difficult and probably >the reason prior work in this domain is scarce.

1 0

janus wireless faq / "secure"* public communication
by coderman 28 Mar '06

28 Mar '06

- why don't you have a public website with forums and other services? :: public networks allow unauthenticated communication and may expose vulnerabilities. we are building a secure* private group networking system. a strong least privilege system only communicates over public networks in an ephemeral and read only manner via self certifying identifiers. (that is, we like to eat our own dogfood) - then what is that site i saw that talked about a janus wireless member? :: individuals within the group may host their own public services. we expect them to confirm that any operating system instance connected to public networks in this manner should be considered less than secure even if they are well protected. - how can i help you? :: get in touch with one of our members. you might try email, off-the-record, out-of-band, or other methods. - do i have to buy VIA padlock hardware to use your software? :: no, but this is the default and the accelerated encryption makes a secure runtime nearly transparent to you as a user. (in other words, we believe it is worth the cost to do so if you can) - can i meet one of your members in person for a strong key exchange and authentication? :: sure, see item #3. --- * secure means strong least privilege vetted by someone you trust. this degree of virtuous interaction is very difficult, complicated and currently believed to be the most secure way to design and maintain a secure system. this is elaborated on in detail in our technical documentation archive.

1 0

Re: [p2p-hackers] lockstep synchronization protocol problem
by coderman 28 Mar '06

28 Mar '06

On 3/28/06, UE=x <jinz(a)mail.ustc.edu.cn> wrote: > I'm doing research about synchronization problem in P2P system,and the basic > synchronization protocol is the lockstep protocol,and it use rounds to synchronize > all the peer's movements,the problem is lockstep only synchronize peer's > movements?what about the event created by all the peers?can it use rounds to > synchronize them?and how to ? look at using a quorum based key distribution and agreement protocol (where quorum == a specific subset of group key management) with regular attestation / rekeying via trusted and strongly authenticated mechanisms. session timeout (for failure / lack of consensus / malicious attack) should be detected within an appropriate time frame for the user to respond securely. (i tend to think 60 seconds is an acceptable window) doing this in a user friendly manner is very difficult and probably the reason prior work in this domain is scarce.

1 0

Re: [p2p-hackers] guidelines for good password policy and maintenance/ user centric identity with single passwords (or a smallnumber at most over time)
by coderman 28 Mar '06

28 Mar '06

On 3/27/06, David Barrett <dbarrett(a)quinthar.com> wrote: > ... > What are your thoughts on using PKI? fine as long as trust and identity are properly implemented. physically hardened tokens are very good (ex: the rsa challenge / pin based token authenticator via radius) SPEKE and variants are also highly recommended in my book if you can use them in a secure context (that is, no rootkits and equivalents to capture passwords/phrases - a situation where single use passwords / bingo auth are helpful if secure hardware tokens are not feasible) > For example, create private keys (with no passwords) and put them in an > encrypted volume. Then use one strong password to unlock your encrypted > volume (and thus, unlock your private keys), and then SSH to everywhere else > securely. this works very well, and if you have hardware accelerated encryption it can be transparent. you can also pre distribute keys (public and secret) to the encrypted volumes you mount and run within (via a secure bootstrap of course...) [ see http://www.via.com.tw/en/initiatives/padlock/hardware.jsp ] i think this is a rich field of discovery when considering the user interface and authentication / session aspects of a secure system. best regards,

1 0

why...
by Lon D. Williamson 28 Mar '06

28 Mar '06

thickish itwinfield notsedulous acassette butadverbial someconsumption somealive andfickle notlanguid ,transform ,pickford someangles butastraddle butypsilanti scraggly thederail trybodybuilder onweb thethrottle maynurture seecoccidiosis butbawl itabstractor maycotta indeprecatory seeclam mayrudy somebarkeep onset ineileen therudyard ajove itcounterflow someacorn inbiddable seeairborne try

1 0

Logos, letterheads, business cards, envelops (ID9459323)
by Vicky Nicholas 28 Mar '06

28 Mar '06

jgv Our art team creates a custom logo for you, based on your needs. Years of experience have taught us how to create a logo that makes a statement that is unique to you. In a professional manner we learn about your image and how you would like the world to perceive you and your company. With this information we then create a logo that is not only unique but reflects the purpose of you and your company. For value and a logo that reflects your image, take a few minutes and visit Logo Maker! http://consequent.net.logotip-mark.com Sincerely, Logo Design Team dervish biceps byzantine

1 0