- cypherpunks-legacy - lists.cpunks.org

Re: BofA+Netscape
by snyderra＠dunx1.ocs.drexel.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 4:18 PM 12/13/94, Jim McCoy wrote: >> The plug for crypto that they have placed in Netscape 0.96 is >> the number one force bringing crypto awareness to the masses. > >Increasing use of PGP is the number one force bringing crypto awareness to >the masses, Netscape is just bringing bad crypto to the masses. No. I could see the argument that PGP is bringing crypto to the masses. I can't see it bring crypto-awareness to the masses. In order to find and use PGP, you have to already be concern about privacy and cryptography. Netscape, on the other hand, by popping up the alert that this traffic isn't being encrypted, and may be evesdropped, is and will get the common folk to think about data security and confidentiality. A lot more people will probably use Netscape than PGP, and the people who use Netscape are the people to whom the wonders of encryption need to be shown. As to whether Netscape's crypto is good or bad, I'll leave that to the chest-pounding "IETF is life. IPSP should be all you need to be happy" folk. Personally, I'd prefer a standards based scheme, and it looks like the NCC folk are looking that way, despited the unwarranted abuse they are getting. >No, the correct response is to stop idotic measures before the build up >enough inertia behind them to make it difficult to prevent mistakes from >being made. It is interesting that the creators of Netscape quite >frequently harp on "it is us against the goliath of Microsoft, so we >deserve the support of the net" and then they go out and do exactly the >sort of thing that makes Microsoft so unpopular; they take advantage of >thier market position to force bad technology on others. They've said they are investigating it. They are here, and they are listening, and looking into it. What do you want of them? Bob -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAwUBLu7gyOS0CjsjWS0VAQGaiQP8CS+uIuxJRQFfP0HW7rrIe15EYvDC19Ry wLtDVoQYl/qeOWo8HyAG/bQ0n4WoHI0QP3a/wafI3fhTF0QBCHROPkVcpUcb0U5T lHGkFhR9+mS+A1hRL5ESKp5L8AYOH9x3r9RWxXDgvdRnWA0vVxEG1oiOiXW7t+Vj yYAJ7JNXEAc= =eKvE -----END PGP SIGNATURE----- -- Bob Snyder N2KGO MIME, PGP, RIPEM mail accepted snyderra(a)post.drexel.edu PGP & RIPEM keys on key servers When cryptography is outlawed, bayl bhgynjf jvyy unir cevinpl.

1 0

Re: THROUGH THE LOOKING GLASS
by snyderra＠dunx1.ocs.drexel.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 8:44 AM 12/13/94, Sandy Sandfort wrote: >Police are public officials. As such, they have no right to >privacy *with respect to their public acts*. When off duty, cops >have the same right as other citizens to privacy in their private >lives. I said my proposal was "anti- *bad* cop" and that it >would benefit good cops. Do I need to say that it would only >benefit good cops in the line of duty? It would be bad for >anyone--cops or civilians--in their private lives. > >Employees represent an intermediate position. If an employer is >foolish enough to require that employees be wired, 'sokay with >me. For most employees in most jobs, it would not be acceptable. >I think they would get jobs with less intrusive employers. Some >employers will wire some employees, whether or not the police are >wired. Wiring the cops is a good idea; arguments about wiring >employees and citizens are nothing more than red herrings used to >avoid addressing the real issue of police accountability. Arguably discussions about police abuses are red herrings used to avoid addressing the real issue of workplace monitoring. :-) I really don't want to know how many sips it takes an officer to finish a cup of coffee, or if the officer has a genital itch problem while sitting in a speed trap. I think this crosses the line. And where do we stop? Do we wire other federal employees? Does the secretary for a research group in the FDA need to be wired? It would be a short jump from this to private sector use, which I do oppose. Not everyone has the ability to pick and choose employment. This has wandered a bit off of Cryptological relevence. I don't plan to reply publically to this thread anymore, although I may do so privately. Bob -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAwUBLu7d0+S0CjsjWS0VAQGa+AP/YSoE66T9JsCFfKUp3spkqhhALYrEF42F SrfApj4YrNRCNHyfV60IOFQem0KZWee6FgzUQHRWjVpFy1Wz3HDZ/vpokCxwTdFi xqG3VbxXgFHm3eQZUTrKueCN5S+P3FkCccHpiz5zlx84619E6u9qH8Ckfak2DBG6 WFJcz4WkUrY= =BxtG -----END PGP SIGNATURE----- -- Bob Snyder N2KGO MIME, PGP, RIPEM mail accepted snyderra(a)post.drexel.edu PGP & RIPEM keys on key servers When cryptography is outlawed, bayl bhgynjf jvyy unir cevinpl.

2 1

Hey Martha! It's "The Invasion from Outer First Virtual" -rated Y (for Y-not)
by nsyfrig＠wppost.depaul.edu 17 Dec '03

17 Dec '03

eric(a)remailer.net (Eric Hughes) wrote (among other things): Regardless of the security, users need to understand what it gives them. This is orthogonal to the choice of security, as well as to the persistence of thick-headedness in society. _________________(non-automatic divider line)___________________ I believe this is definitely a proverbial nail, and it has just been hit where it counts! Some evangelizing, education, and teamwork is definitely in order here. As implied, it doesn't just apply to the virtual world, but the real one as well.

1 0

Sony's WWW server (NEWSWAVE) was opened
by Tsuyoshi Hayashi 17 Dec '03

17 Dec '03

Hi, punks, Sony, our parent company, began to provide several info and technical support for NEWS users on the WWW server. # Note that 'NEWS' is Sony's UNIX workstation. # Mainly, NEWS are used in Japan. # So, you probably don't know it... The Home Page is at URL: http://www1.sony.co.jp/ CAUTION: (1) The home page of it has large graphics data. (2) Homepage has some Japanese characters. So you can not read there probably. If you have time, peek it please. Thanks. P.S. This home page is NOT the (all of) Sony's home page. This page is managed by a NEWS support group. | Tsuyoshi Hayashi (hayashi(a)scs.sony.co.jp) | Tech. div., Sony Computer Systems Inc.

1 0

Re the Pentium Bug
by NetSurfer 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- NASIRC BULLETIN #94-36 December 13, 1994 Floating Point Divide Flaw in Intel Pentium Processor Chip ============================================================ __ __ __ ___ ___ ____ ____ /_/\ /_/| /_/ / _/\ /_/| / __/ \ / __/\ | |\ \| || / \ \ | /\/ | || | /\ \/ | | \/ | ||\ \ || / /\ \ \ \ \ | || |_\/ /\ | | | || \ \|| / /--\ \ \ /\_\\ | || | |\ \ \ | \_/\ |_|/ \_|//_/ \_\/ \/__/ |_|/ |_| \_\/ \___\/ NASA Automated Systems Incident Response Capability ============================================================ NASIRC has become aware of a floating-point division problem in some versions of the Pentium processor chip, manufactured by Intel. Although this is not a security issue, NASIRC is bringing this to your attention because the defect could cause erroneous results for NASA projects which rely on complex mathematical computations involving double-precision arithmetic. Information on this problem is currently being propagated through the Internet and both technical and general publications. We are issuing this bulletin to provide a synopsis of what is known about the problem, how to check for the flaw, and what to do about it. It is important that any individual who uses a computer utilizing a Pentium processor perform the test(s) described in this bulletin on his/her machine to check for the bug. Although there have been reports the Pentium/60 is not affected, NASIRC recommends these units also be tested. There is no part number or other marking which would designate the flawed processor chips from the later revisions, which do not contain the bug. Intel considers this flaw to be minor, and has stated: "the average spreadsheet user should only be affected by this bug once every 27,000 years". However, NASIRC feels there is a high probability that work done on this class of desktop system in NASA is most likely to be computationally intensive, and the likelihood of achieving erroneous results is strong. From a reliability and reputation standpoint, NASA must ensure that the tools it uses to accomplish its mission perform properly. The president of Intel has issued a communique, stating his company's position on the problem, and the the process to follow should a site discover a flawed system. The communique is available via WWW at the URL: http://www.intel.com/about-intel/press/andy-msg.html. Pentium machines can be tested by using any of the following three methods: 1) Using the Microsoft Windows calculator, perform the following computation: x = 4195835 y = 3145727 z = x - (x/y)*y If z = 256, your chip has the bug. The Windows calculator is the easiest way to run this test. If you program this calculation, be sure to use to use double-precision variables! 2) Using any spreadsheet application (Lotus 1-2-3, Excel, etc), perform the following test: Enter the following data: In cell A1: 4195835 In cell A2: 3145727 In cell A3: 3145727 Calculate the following value: (A1 * A2)/A3 A correct result is: 4195835 An incorrect result (FDIV bug) is: 4195579 3) A small program named P87TEST.COM, to test for the existence of the bug was written and made available over the Internet by Terje Mathisen of Norsk Hydro A/S in Norway. A binary copy of P87TEST.COM can be obtained via anonymous FTP from the NASIRC online archive at the following URL: ftp://nasirc.nasa.gov/toolkits/diagnostics/Intel/p87test.com The Checksums are as follows: MD5: 322E8857C126D7CA336E7FFC31800939 SunOS: 08334 2 To run the program, simply type: P87TEST. An example of the program output is as follows: Pentium FDIV bug finder. (c) Terje Mathisen 1994 This is a Pentium or better cpu CPUID reports back: Vendor id = "GenuineIntel" Family (4=486, 5=Pentium etc.) = 05, stepping = 05, model = 01 CPU feature list: 1 : FPU (NDP) onchip 2 : Virtual 86 Mode Extensions 4 : I/O Breakpoints 8 : Page Size Extensions 10 : Time Stamp Counter 20 : Pentium stype MSRs 80 : Machine Check Exception 100 : CMPXCHG8B instruction available It has a 387 or later ndp It has the FDIV bug: (1.0/824633702449.0)*824633702449.0 is not equal to 1.0! Intel has stated that any site experiencing problems from this bug can obtain a replacement processor chip at no charge. Intel has set up a special customer service phone number for users affected by this bug. The Intel customer service desk can assist with obtaining replacement processor chips for affected systems. Any site confirming the existence of the bug in their Pentium chipset should contact Intel at 1-800-628-8686. If you have any questions about this bulletin, please contact the NASIRC Helpdesk. =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= NASIRC ACKNOWLEDGES: Mr. Bob Solomon of the NASA Lewis Research Center for providing the information used in this bulletin, and Mr. Terje Mathisen of Norsk Hydro A/S for creating the pro- gram to test a system for the bug. =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= =============================================================== For further assistance, please contact the NASIRC Helpdesk: Phone: 1-800-7-NASIRC Fax: 1-301-441-1853 Internet Email: nasirc(a)nasa.gov 24 Hour/Emergency Pager: 1-800-759-7243/Pin:2023056 STU III: 1-301-982-5480 =============================================================== This bulletin may be forwarded without restriction to sites and system administrators within the NASA community. The NASIRC online archive system is available via anonymous ftp. You will be required to enter your valid e-mail address as the "password". Once on the system, you can access the following information: ~/bulletins ! contains NASIRC bulletins ~/information ! contains various informational files ~/toolkits ! contains automated toolkit software The contents of these directories is updated on a continuous basis with relevant software and information; contact the NASIRC Helpdesk for more information or assistance. ----------------- PLEASE NOTE: Users outside of the NASA community may receive NASIRC bulletins. If you are not part of the NASA community, please contact your agency's response team to report incidents. Your agency's team will coordinate with NASIRC, who will ensure the proper internal NASA team(s) are notified. NASIRC is a member of the Forum of Incident Response and Security Teams (FIRST), a world-wide organiza- tion which provides for coordination between incident response teams in handling computer-security-related issues. You can obtain a list of FIRST member organizations and their constituencies by sending email to docserver(a)first.org with an empty "subject" line and a message body containing the line "send first-contacts". ************************************************************************* * Richard K. Yamane Leeward Community College * * Manager, Computer Center 96-045 Ala Ike * * Pearl City, Hawaii 96782 * * EM: sysrich(a)lccada.lcc.hawaii.edu * * Ph: (808) 455-0493 (Univ. of Hawaii campus) * ************************************************************************* ************************************************************************** *Marv Weissman * UH Computer Specialist * Leeward Community College * *cs_weissman(a)lccada.lcc.hawaii.edu (808)455-0465, voice. 455-0471, fax * * * * "Don't worry about what may happen tomorrow; just correct what you * * spoiled yesterday" * * * * (Midrash ) * * * ************************************************************************* - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLu8yTyoZzwIn1bdtAQFVBgF6Agd6s2YAeRmBSsUiyLzvN15OoRdQObIk A0F8v9dG5xuHXyp/hWYHKzX6QIA0a6KP =544j -----END PGP SIGNATURE-----

1 0

(fwd) I don't use PGP. (Was:I NUKED PGP.)
by Connie Sadler 17 Dec '03

17 Dec '03

Subject: (fwd) I don't use PGP. (Was:I NUKED PGP.) From: "Connie Sadler"@MR.STANFORD.EDU Date: Wed, 14 Dec 1994 10:28:00 PDT A1-type: DOCUMENT Posting-date: Wed, 14 Dec 1994 00:00:00 PDT <Black Unicorn says: <I'm a Mac user. <MacPGP is a general nightmare. For those of us who have shell accounts, <it is such a annoyance as to cause me to dislike using it at all except for <the most extreme messages. <I fear I am not of the ability, or of the spare time to work on making a <seamless application myself or else it surely would have been a project <on the top of my list. <PGP needs to be a drop and drag application. I want a box sitting on my <desktop, a box I can drag any document to and press two buttons after a <mouse click and drag and encrypt/decrypt/sign a message which can then be <copy/pasted to Zterm. Currently the only thing that nears the <transparancy of this sort of thing is the bulky, annoying, poorly <packaged and massively oversized, not to mention rarely working, MacPGP <Kit. It doesn't seem to work out to any time advantage when I factor in <the debugging and outright code crashes into my computation. <The modular PGP project has been out there for almost a year. Any <progress on this front? Does anyone care? <Now that some lists are beginning to delay or reject unsigned messages <altogether, I would really like to be able to reply to a simple note in <less than the 7 minutes it currently takes me. <This is the single most problematic hitch in PGP. It's not easy to use, <to install, or to apply. <Every move toward transparent crypto simply serves to increase user base <and deter a prospective ban. It should be in EVERYONE's interest to try <and push for a easier front end, while still allowing a flexible and <detailed set of advanced options for the expert user. <Curve Encrypt is a classic example of simplicty and ease. PGP front end <designers for the Mac should take its example. <-uni- (Dark) <Spelling errors disclaimed, I've been up for 30 hours. I just have to say AMEN to this message. I LOVE PGP but agree with the writer that until we make it easier to use (drag and click!), we're losing many, many potential users out there. I, too, will keep my fingers crossed. And who knows? Maybe one day, I'll develop enough technical skill to do something about it myself - I'm working on it. Connie

1 0

Re: Big Brother database
by Alex Strasheim 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- > >Do we then have a de facto (cardless) national ID? I think so. > > You got it, Bunky. There's an article in Forbes (the latest copy?) about a company that's making thermal scanning devices which can identify people via the pattern of blood vessels in their face. The advantage of this system over fingerprinting is that it can be done without letting the target know he or she's being identified. == Alex Strasheim | finger astrashe(a)nyx.cs.du.edu alex(a)omaha.com | for my PGP 2.6.1. public key -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLu8mOREpP7+baaPtAQHgjQP/e+eHxzEKuigSihr/wYfUiUrF2fKzI04U r7rQESL4GNG7UOJOisTmSbp9YYB1fMlAPgu0JkWk22YxbgqXIPMnVhyfsWjzH0d8 z5EZ3/8F+MgXqTowY2weuWvsUx8VKFbHsePDemaKjIAEaRUz7R0kVbpMc57XUFMY 9LLKfAYswiQ= =GEuy -----END PGP SIGNATURE-----

2 1

(fwd) I don't use PGP. (Was:I NUKED PGP.)
by Black Unicorn 17 Dec '03

17 Dec '03

Path: news1.digex.net!access1!unicorn From: unicorn(a)access1.digex.net (Black Unicorn) Newsgroups: alt.security.pgp Subject: I don't use PGP. (Was:I NUKED PGP.) Date: 14 Dec 1994 18:11:29 GMT Bretton Wade (bw16(a)cornell.edu) wrote: : In article <3clri0$jqn(a)crl.crl.com>, jdulaney(a)crl.com (John Dulaney) wrote: : > 1) Too difficult to setup for the average user. : The "average" user of PGP is somebody who understands why they need PGP. : I'd say almost everybody with that level of knowledge is capable of : understanding "type randomly for a while", and the three or four standard : options to pass to PGP for day to day use. : > 3) I may forget to decrypt and miss an important note. : pay attention. If you need the security... : > 2) Requires that I exit my E-mail reader to decrypt which takes : > too much time. : > : > Suggestions: : > 1) Make it operable INSIDE PINE for example. : > 2) Put it in EUDORA or other MOSAIC/NETSCAPE browser and make it : > work AUTOMATICALLY, seemlessly, in the background. : > : read the newsgroup for about 30 seconds before you post. A lot of people : have put a lot of work into this sort of stuff. Some good, some not so : good, but that is for you to evaluate. : Bretton I'm a Mac user. MacPGP is a general nightmare. For those of us who have shell accounts, it is such a annoyance as to cause me to dislike using it at all except for the most extreme messages. I fear I am not of the ability, or of the spare time to work on making a seamless application myself or else it surely would have been a project on the top of my list. PGP needs to be a drop and drag application. I want a box sitting on my desktop, a box I can drag any document to and press two buttons after a mouse click and drag and encrypt/decrypt/sign a message which can then be copy/pasted to Zterm. Currently the only thing that nears the transparancy of this sort of thing is the bulky, annoying, poorly packaged and massively oversized, not to mention rarely working, MacPGP Kit. It doesn't seem to work out to any time advantage when I factor in the debugging and outright code crashes into my computation. The modular PGP project has been out there for almost a year. Any progress on this front? Does anyone care? Now that some lists are beginning to delay or reject unsigned messages altogether, I would really like to be able to reply to a simple note in less than the 7 minutes it currently takes me. This is the single most problematic hitch in PGP. It's not easy to use, to install, or to apply. Every move toward transparent crypto simply serves to increase user base and deter a prospective ban. It should be in EVERYONE's interest to try and push for a easier front end, while still allowing a flexible and detailed set of advanced options for the expert user. Curve Encrypt is a classic example of simplicty and ease. PGP front end designers for the Mac should take its example. -uni- (Dark) Spelling errors disclaimed, I've been up for 30 hours. -- 073BB885A786F666 nemo repente fuit turpissimus - potestas scientiae in usu est 6E6D4506F6EDBC17 quaere verum ad infinitum, loquitur sub rosa - wichtig!

2 1

Less Flaming, More Civility
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

Folks, the level of flaming and gratuitous insulting (insultations?) is getting in the way of our message. We have on our list folks from Netscape, First Virtual, and (maybe) Digicash. Amongst others. And we certainly know that some of our messages are being forwarded to others. It behooves us to bear this in mind. If we can't calmly and clearly make our points about why privacy is important (and I mean in the sense of personal responsibility, not just the buzzword), about why end-to-end encryption is generally better than transport-level security, and about why "certifying authorities" is (to many of us) a flawed approach, then we are failing. More concisely, the Cypherpunks list is one of several "watering holes" that have appeared. Rather than trashing schemes which are not "'punkly correct" (PC, to coin a term), or which seem to have been put together in haste (perhaps for good reason)), we should instead use this golden opportunity to influence things. Call me an elitist, but I think the Cypherpunks list has an important role to play in influencing: -- Web development (Netscape, InterCon, others) -- digital cash (DigiCash, First Virtual, others) -- key escrow policies and plans (TIS, Microsoft, etc.) -- the future of PGP, tools, etc. -- etc. These things will have more of an effect on the future than convincing Aunt Erma to encrypt her mail. It may be that the comments made here about the security model of Netscape and First Virtual are on the mark, that these models need a lot more work. But I don't know see how insults or derision, or imputing bad motives to these folks, will help. (I think I was careful this past motive to avoid slinging mud at Bill Gates, for example, during the debate about reports that Microsoft could be including some form of key escrow in future OS releases. Not to say I've never flamed...) One lesson that's become clear is to expect that derisive comments made here will often find their way back to those derided. I always write with the expectation that folks as disparate as David Chaum and Dorothy Denning will perhaps be reading my words! (Hi, David! Hi, Dotty!) They may read them because someone forwards the messages to them, or because in 1996 the Cypherpunks list is sold on CD-ROM, or because one of them has access to the main NSA search engines (:-}). Whatever, my point is that insults are rarely helpful, and are unpersuasive. Insults also set a tone for later debate that is hard to get beyond. Not all debate recently has been insulting, of course. In fact, most hasn't been. But the insulting tone persists in some of the thread titles, and in the generally adversarial nature. (If I were Marc A. or Kipp, I'd not feel very welcome here....a situation which is counterproductive to our presumed goals.) Hal Finney nicely summarized why folks want some privacy on Web pages, and why transport-level security is generally less desirable than end-to-end security (including the special case of anonymous origination). This is the usual "who do you trust?" motif, which comes up in mail delivery _and_ in key certification. (Sidebar: In my view, Web browsers like Netscape and Mosaic, etc., should not get overly involved in these issues. These are issues for Web page owners to worry about and set policy on. The browsers may want the right hooks in them to allow authentication policies to be implemented, but the browser-makers should probably stay out of the gory details of which crypto algorithms are used, what access policies are set, etc. This makes it easier to drop-in stronger systems at a later time. I may be misunderstanding plans, I admit.) So, this is my little rant on "Can't we all just get along?" expressed in a different way. The Cypherpunks list has become one of several de facto "watering holes" where diverse participants interact. Let's not blow it. --Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. Cypherpunks list: majordomo(a)toad.com with body message of only: subscribe cypherpunks. FAQ available at ftp.netcom.com in pub/tc/tcmay

14 33

Re: Clarification of my remarks about Netscape
by kipp＠warp.mcom.com 17 Dec '03

17 Dec '03

In article <199412140047.QAA17489(a)jobe.shell.portal.com>, you write: > -----BEGIN PGP SIGNED MESSAGE----- > > "Amanda Walker" <amanda(a)intercon.com> writes, quoting someone from > Netscape: > > >> I didn't bother imbedding the RSA Unaffiliated User CA because I > >> didn't think server operators would use it to get certificates. > > >Well, it's what Apple is using for PowerTalk signers (which are a key pair and > >X.509 certificates, by default from the Unaffiliated User PCA). It makes > >sense for personal (as opposed to organizational) servers, such as someone > >running MacHTTP for their home page... > > >On the other hand, if RSA has set up a server PCA, that should be suffcient > >for now. I wonder what the certification policy is, though--how do you prove > >that you control a given server? For an Unaffiliated User CA certificate, you > >just have to show a notarized application and two forms of ID, one with a > >photo (driver's license, passport, etc.). I can't off hand think of an > >equivalently strong way to ID control of a server... > > This relates to the other part of my question, which didn't get answered: > what is the relationship between the name found in the X.509 certificate > and the server? Does X.509 include an internet address like mcom.com, > and the Netscape client checks that this matches the address of the > server it is connecting to? I am not very familiar with the certificate > format but I had the impression that it used a very different naming > scheme. > > Or does the client accept any valid certificate without regard to the > connection if any between the name in the certificate and the server to > which it is connected? This whole area was left undefined in the SSL > spec but will be important for interoperability. > > Hal > > -----BEGIN PGP SIGNATURE----- > Version: 2.6 > > iQBVAwUBLu5AkhnMLJtOy9MBAQEFQgH/dmiiEjycULNdDCNiU8SkoB57bHv9W5Lc > d+K7cBqq0ZknCwXtqZtbPTR7d8F1z0WFbMlP6QF3zywVz2GrDIg5kg== > =qQ9u > -----END PGP SIGNATURE----- >From the spec, the appendix on certificates: Certificates are validated using a few straightforward steps. First, the signature on the certificate is checked and if invalid, the certificate is invalid (either a transmission error or an attempted forgery occurred). Next, the CertificateInfo::issuer field is verified to be an issuer that the application trusts (using an unspecified mechanism). The CertificateInfo::validity field is checked against the current date and verified. Here is what we do in Netscape (for now). We have imbedded a set of certificates in the client. The certificates are for issuers of certificates that "we" trust. Any server which is certified by one of these issuers will be automatically trusted by the Netscape Navigator... Admittedly this is primitive, but it's a start. --------------------------------------------------------------------- Kipp E.B. Hickman Netscape Communications Corp. kipp(a)mcom.com http://www.mcom.com/people/kipp/index.html

1 0