Re: telnet replacement - not ssh?

From: Richard E. Silverman (slade@shore.net)
Date: 01/13/03


From: slade@shore.net (Richard E. Silverman)
Date: 13 Jan 2003 15:45:09 -0500


>>>>> "VA" == Vic Abell <abe@cc.purdue.edu> writes:

    VA> Richard E. Silverman <slade@shore.net> wrote:
>> Also, I don't know what you mean by the "nonce for the session" --

    VA> Nonce is a term used to name the pseudo-random number, generated
    VA> by each peer during an authentication exchange, and encrypted by
    VA> the other peer's public key before transmission to it.

As should be clear from the next sentence you didn't quote:

"although there are various places in the protocol where either side
 generates random values,..."

... I am well aware of the meaning of the term "nonce" in cryptography,
thanks. My point was, as stated, that I don't know what he's talking
about, since the term does not even appear in the RFC; neither can I think
of anything nonce-like in the key exchange phase to which it could refer.
The closest things are the cookies exchanged in the first kex packets, but
that doesn't work. Furthermore, in the context of the OP's argument, it
doesn't matter *what* he's referring to, as nothing in the key exchange is
covered by the session cipher anyway, and so cannot be compromised by a
poor choice of cipher.

-- 
  Richard Silverman
  slade@shore.net


Relevant Pages

  • Re: RSA Key Exchange
    ... Server B, so it initiates a request saying "Hey... ... At this point is where we can do key exchange, how we want to do it is up to ... So client A says "Hey, here's my public key, encrypt all packets coming out ... Now each one has a public key, so secured communications continue. ...
    (microsoft.public.dotnet.languages.vb)
  • Re: New Method for Authenticated Public Key Exchange without Digital Certificates
    ... so i ask to exchange keys with somebody ... ... while such a extended man-in-the-middle attack isn't impossible ... things that are the public key exchange ... ... so an ongoing man-in-the-middle substitution attack on typical PGP ...
    (sci.crypt)
  • Re: A way to append disclaimer to all ourbound messages?
    ... How to add a disclaimer to outgoing SMTP messages in Visual Basic ... > that is sent from our exchange 2000 server. ... for the sole purpose of delivery to the intended recipient. ... > Any reproduction or dissemination of this transmission is strictly ...
    (microsoft.public.exchange2000.admin)
  • Re: Key establishment question
    ... machines need to exchange two random numbers, e.g., R1, R2, if ... Diffie-Hellman is used. ... encrypt it with my private key. ... The fact that my public key decrypts ...
    (comp.security.misc)
  • Re: Reading encrypted mail?
    ... Exchange Reporting & Analysis: http://www.quest.com/messagestats/ ... There's a public key and private key involved ... ... >>> delegated mailbox access to read received encrypted messages in the ...
    (microsoft.public.exchange.admin)