Re: MITM in the wild

2008-11-10 Thread Ian G
Eddy Nigg wrote: On 11/10/2008 04:31 PM, Ian G: Eddy Nigg wrote: [EMAIL PROTECTED] is hardly a legal identity... That's because there is no such thing as a "legal identity." I think he meant with "legal" your legally given name as listed in your passport for example or an organization as

Re: DNSSEC? Re: MITM in the wild

2008-11-10 Thread Paul Hoffman
At 11:52 AM -0800 11/10/08, Nelson Bolyard wrote: >DNSSEC only attempts to ensure that you get the (a) correct IP address. s/only/only currently/ You can stick any data you want in the DNS. Currently the most popular data is the A record (IP address) associated with a domain name, but is it quit

RE: DNSSEC? Re: MITM in the wild

2008-11-10 Thread Alaric Dailey
DNSSEC is an assertion of validitity of the DNS. EV certs assert that the business behind the cert is legit. Certs regardless of the class enables encryption. Thus DNSSEC would, in theory, prevent a cert from being stolen. So rather than replacing, or weakening CAs and PKI, it would enhance rel

Re: DNSSEC? Re: MITM in the wild

2008-11-10 Thread Graham Leggett
Nelson Bolyard wrote: I haven't followed this lengthy discussion in detail but I have for a long time wondered how DNSSEC and SSL-CA-Certs should coexist. Which one will be the "most" authoritative? Could DNSSEC (if it finally succeeds) be the end of SSL-CA-certs? DNSSEC only attempts to ens

Re: MITM in the wild

2008-11-10 Thread Eddy Nigg
On 11/10/2008 04:31 PM, Ian G: Eddy Nigg wrote: [EMAIL PROTECTED] is hardly a legal identity... That's because there is no such thing as a "legal identity." I think he meant with "legal" your legally given name as listed in your passport for example or an organization as registered and au

Re: DNSSEC? Re: MITM in the wild

2008-11-10 Thread Eddy Nigg
On 11/10/2008 09:52 PM, Nelson Bolyard: Anders Rundgren wrote: I haven't followed this lengthy discussion in detail but I have for a long time wondered how DNSSEC and SSL-CA-Certs should coexist. Which one will be the "most" authoritative? Could DNSSEC (if it finally succeeds) be the end of SS

Re: DNSSEC? Re: MITM in the wild

2008-11-10 Thread Nelson Bolyard
Anders Rundgren wrote: > I haven't followed this lengthy discussion in detail but I have for a long > time wondered how DNSSEC and SSL-CA-Certs should coexist. > > Which one will be the "most" authoritative? > > Could DNSSEC (if it finally succeeds) be the end of SSL-CA-certs? DNSSEC only attemp

Re: MITM in the wild

2008-11-10 Thread Ian G
Eddy Nigg wrote: On 11/10/2008 02:11 AM, Kyle Hamilton: On Sun, Nov 9, 2008 at 7:26 AM, Eddy Nigg<[EMAIL PROTECTED]> wrote: Since there's a fairly argumentative tone going on, I think I should explain what my viewpoint is: Kyle, your reply was highly interesting! Nevertheless I'll cut down my

can't access PKCS #11 Conformance Testing sources

2008-11-10 Thread 133mmx
Hi all; I m looking source codes of PKCS #11 Conformance Testing tool. On the page http://www.mozilla.org/projects/security/pki/pkcs11/ says it is available in mozilla/security/nss/test/pkcs11/. Is there any opinion ___ dev-tech-crypto mailing list dev-te