X9.59 mailing list

x959 Postings and Posting Index,
next, previous - home

DNS Request and Transaction Signatures ( SIG(0)s )
RFC2915 ... The Naming Authority Pointer (NAPTR) DNS Resource Record
Some PKI references from yesterday's SlashDot
X9.59 on its way to ANSI 60 day public comment ... fyi
hackers crack egghead.com

DNS Request and Transaction Signatures ( SIG(0)s )

From: Lynn Wheeler
Date: 09/22/2000 10:51
To: ansi-epay@xxxxxxxx
Subject:

recent published RFC regarding digital signatures and domain name system

additional RFC information is available at:

https://www.garlic.com/~lynn/rfcietff.htm

A new Request for Comments is now available in online RFC libraries.

RFC 2931

Title:     DNS Request and Transaction Signatures ( SIG(0)s )
Author(s):  D. Eastlake 3rd
Status:     Standards Track
        Date:       September 2000
Mailbox:    Donald.Eastlake@xxxxxxxx
        Pages:      10
Characters: 19073
Updates:    2535

        I-D Tag:    draft-ietf-dnsext-sig-zero-02.txt

        URL:        ftp://ftp.isi.edu/in-notes/rfc2931.txt

Extensions to the Domain Name System (DNS) are described in [RFC 2535] that can provide data origin and transaction integrity and authentication to security aware resolvers and applications through the use of cryptographic digital signatures.

Implementation experience has indicated the need for minor but non-interoperable changes in Request and Transaction signature resource records ( SIG(0)s ). These changes are documented herein.

This document is a product of the DNS Extensions Working Group of the IETF.

This is now a Proposed Standard Protocol.

RFC2915 ... The Naming Authority Pointer (NAPTR) DNS Resource Record

From: Lynn Wheeler
Date: 09/27/2000 10:45 AM
To: ansi-epay@xxxxxxxx
Subject: RFC2915 ... The Naming Authority Pointer (NAPTR) DNS Resource	Record

with respect to early discussion of using domain name system as authoritative reference for various types of information .... this RFC expands on DNS resource record formats.

This allows the DNS to be used to lookup services for a wide variety of resource names (including URIs) which are not in domain name syntax. Reasons for doing this range from URN Resource Discovery Systems to moving out-of-date services to new domains. This document updates the portions of RFC 2168 specifically dealing with the definition of the NAPTR records and how other, non-URI specific applications, might use NAPTR.

Some PKI references from yesterday's SlashDot

From: Lynn Wheeler
Date: 11/12/2000 01:47 PM
To: ansi-epay@xxxxxxxx
Subject: Some PKI references from yesterday's SlashDot

http://slashdot.org/articles/00/11/11/1517235.shtml

....

Public Key Infrastrucre: An Artifact Ill-Fitted to the Needs of the Information Society

http://www.anu.edu.au/people/Roger.Clarke/II/PKIMisFit.html

&

privacy implications of digital signatures

http://www.anu.edu.au/people/Roger.Clarke/DV/DigSig.html

The Willingnes of Net-Consumers to Pay: A Lack-of-Progress Report

http://www.anu.edu.au/people/Roger.Clarke/EC/WillPay.html

Ten Risks of PKI: What You're Not Beind Told About Public Key Infrastructure

http://www.counterpane.com/pki-risks.html

X9.59 on its way to ANSI 60 day public comment ... fyi

From: Lynn Wheeler
Date: 12/25/2000 10:27 AM
To: ansi-epay@xxxxxxxx
Subject: X9.59 on its way to ANSI 60 day public comment ... fyi

X9.59 has passed and is on its way to ANSI for the 60 day public comment period.

several things were corrected in the ASN.1 definition (compared to earlier drafts of the standard) so that it now compiles correctly. the most notable change in the ASN.1 definition was the removal of the ASN.1 specifications involving digital signing. The X9.59 ASN.1 definition now specifically covers the fields in the digital objects & references existing standards as to implementation of digital signatures.

hackers crack egghead.com

From: Lynn Wheeler
Date: 12/25/2000 11:51 AM
To: ansi-epay@xxxxxxxx
Subject: hackers crack egghead.com

presumably many people are already aware of this news.

misc. other (last month) discussion in comp.security:

https://www.garlic.com/~lynn/2000g.html#5

Hackers crack Egghead.com
By Robert Lemos and Ben Charny
Special to CNET News.com
December 22, 2000, 3:00 p.m. PT
update

Egghead.com executives scrambled Friday to gauge how much of its 3.7-million-customer database had been stolen by intruders during an online theft, which experts believed happened the day before.

http://news.cnet.com/news/0-1007-201-4245328-0.html?tag=st.ne.1007.thed.sf

x959 Postings and Posting Index,
next, previous - home