Usenet Conference on Security

Just a few of the highlights:

(1) Ron Rivest speaking on SDSI
(2) Ian Goldberg et.al's secure environment for running untrusted programs
in Solaris.  Since it runs Netscape, it may let Perry provide a second
layer of containment for Java.
(3) Carl Ellison's "Establishing Identity Without Certification Authorities
(4) Peter Gutmann's "Secure Deletion of Data from Magnetic and Solid-State
Memory".  (Bottom line, use thermite for magnetic media.)
(5) Don Davis's "Compliance Defects in Public Key Cryptography"
(6) Sameer Parekh's description (advertisement for) Community Connexion
(7) Derek Atkins' description of the PGP Library API.

Other amusements:

While the Department of Justice guy (whose name slips my mind) was saying 4
horsemen over and over (really an oversimplification of his position), Data
Fellows Ltd., Paivantaite 8, FIN-02210 ESPOO, Finland
(http://www.datafellows.com) was in the vendor area offering strong crypto
products with the line in one of their handouts, "This is orders of
magnitude more security than DES-based or US products that are under the US
ITAR export restrictions."  In talking with them I didn't smell any snake
oil.

A BOF on PKI with Ron Rivest (who had already described SDSI) where Matt
Blase describing PoliceMaker, and Carl Ellison described SPKI.  All three
approaches get away from the central certificate hierarchy God.  Each one
has something to offer that the other do not.  (In a spirit of
advertising/disclosure, I have been working with Carl on SPKI.)


-------------------------------------------------------------------------
Bill Frantz       | Cave ab homine unius lebri | Periwinkle -- Consulting
(408)356-8506     |  [Beware the man of one    | 16345 Englewood Ave.
frantz@netcom.com |   book]  - Anonymous Latin | Los Gatos, CA 95032, USA

Bill Frantz writes:
> While the Department of Justice guy (whose name slips my mind) was saying 4
> horsemen over and over (really an oversimplification of his position), Data
> Fellows Ltd., Paivantaite 8, FIN-02210 ESPOO, Finland
> (http://www.datafellows.com) was in the vendor area offering strong crypto
> products with the line in one of their handouts, "This is orders of
> magnitude more security than DES-based or US products that are under the US
> ITAR export restrictions."  In talking with them I didn't smell any snake
> oil.

As an aside, the stuff Datafellows is selling is, I believe, a
commercial version of SSH, which is very good stuff. Its a full
replacement for the whole berkeley "r" utilities using strong crypto
(public key and conventional) for authentication and privacy. Does
rlogin, rsh, redirects X sessions, slices and dices, etc. Really
spiffy.

(SSH suffers from a few minor flaws, but they will likely be corrected
in the future; the only thing that worries me about it is that it is
very large and thus hard to fully analyse, but it looks good enough
that I've been using it day to day for many many months for all my
medium security work.)

Perry