Re: Cryptanalysis of SecurID (ACE/Server)

Alex Alten (Alten@Home.Com)
Thu, 01 Oct 1998 04:16:17 -0700

• Next message: Brown, R Ken: "RE: propose: `cypherpunks license' (Re: Wanted: Twofish source co de)"
• Previous message: Andy Brown: "=?iso-8859-1?Q?Re=3A_propose=3A_=60cypherpunks_license=27_=28Re=3A_Wanted?= =?iso-8859-1?Q?urce_code=29?="

At 04:03 PM 9/30/98 -0400, Perry E. Metzger wrote:
>
>Vin McLellan writes:
>> Perry Metzger <perry@piermont.com> dismissed the whole genre of
>> hand-held authentication tokens: "In a world of TCP hijacking, who cares if
>> the one time system is good?"
>>
>> (Maybe someone who really wants to know who is coming through the VPN?)
>
>Given TCP hijacking, it won't tell you who is coming through the
>VPN. You need a strong cryptographic authentication system for the
>entire session anyway, which makes SecureID less useful.

Perry is right. You need to secure your packets independently of the
underlying transport or network protocol machinery. This security
must be based on cryptographic techniques for establishing identity,
authorization, and data integrity.

- Alex

--
Alex Alten
Alten@Home.Com
Alten@TriStrata.Com
P.O. Box 11406
Pleasanton, CA  94588  USA
(925) 417-0159

• Next message: Brown, R Ken: "RE: propose: `cypherpunks license' (Re: Wanted: Twofish source co de)"
• Previous message: Andy Brown: "=?iso-8859-1?Q?Re=3A_propose=3A_=60cypherpunks_license=27_=28Re=3A_Wanted?= =?iso-8859-1?Q?urce_code=29?="