[30443] in Perl-Users-Digest
Perl-Users Digest, Issue: 1686 Volume: 11
daemon@ATHENA.MIT.EDU (Perl-Users Digest)
Wed Jul 2 16:09:45 2008
Date: Wed, 2 Jul 2008 13:09:08 -0700 (PDT)
From: Perl-Users Digest <Perl-Users-Request@ruby.OCE.ORST.EDU>
To: Perl-Users@ruby.OCE.ORST.EDU (Perl-Users Digest)
Perl-Users Digest Wed, 2 Jul 2008 Volume: 11 Number: 1686
Today's topics:
[OT] Re: RSA implementation, please comment. <m@rtij.nl.invlalid>
kill process when file number reached... <lancerset@gmail.com>
Re: kill process when file number reached... <smallpond@juno.com>
Re: looping issue <rvtol+news@isolution.nl>
Re: My c code has stopped working: PL_errgv NULL? <petasis@iit.demokritos.gr>
Re: My c code has stopped working: PL_errgv NULL? <fawaka@gmail.com>
Re: My c code has stopped working: PL_errgv NULL? <petasis@iit.demokritos.gr>
new CPAN modules on Wed Jul 2 2008 (Randal Schwartz)
Re: RSA implementation, please comment. <john@linuxNOSPAMlad.org>
Re: RSA implementation, please comment. <m@rtij.nl.invlalid>
Re: RSA implementation, please comment. <fawaka@gmail.com>
Re: The Importance of Terminology's Quality <jwkenne@attglobal.net>
Digest Administrivia (Last modified: 6 Apr 01) (Perl-Users-Digest Admin)
----------------------------------------------------------------------
Date: Wed, 2 Jul 2008 10:26:03 +0200
From: Martijn Lievaart <m@rtij.nl.invlalid>
Subject: [OT] Re: RSA implementation, please comment.
Message-Id: <pan.2008.07.02.08.26.03@rtij.nl.invlalid>
[ This has nothing to do with Perl. If you want to continue the
conversation, find an appropriate group or take it to mail ]
On Tue, 01 Jul 2008 17:24:08 -0700, Rob wrote:
Although I'll try to improve on your security, you'ld best take a step
back and look at the whole problem again. Storing the creditcard details
on a separate server is actually a very good idea, because a server with
less functions is easier to secure.
So set up a web front. This web front uses a well defined and secure
channel to talk to the credit-card-details server. This must go through a
firewall that allows nothing else from web front to credit-card-details
server.
The protocol should be custom defined, well implemented by someone used
to secure coding and only allow storing the details, not deleting,
altering or retrieving them (some retrieval may be necessary, but never
the card number). If alteration is a must, this must be very carefully
implemented, probably by sending a new card record and storing a link to
the new record, not deleting the old record. Avoid the temptation to use
a raw database connection. Even when the database itself is properly
secured (which it should be), you take away one layer of defense and rely
on the database security alone, which is notoriously hard to get right.
The clients use well defined and secure channels to talk to this server.
Start with allowing only access from specific IPs. Using certificates on
smart cards is a common way to further secure this access. Also pay
attention to administrative access, this should be even more secure.
Only with this setup you can be reasonably secure. Public webservers get
hacked way more often than dedicated servers, by splitting your
functionality between a public webserver and a dedicated backend server
you can avoid damage when your webserver gets hacked.
And pay attention to backup! The number of times I've seen setups like
the above, all computers secured, behind a dedicated firewall, all
perfectly according to the book, only to find that the backup network
ties them all together again without a firewall in sight.
If you have all the above right, you can start implementing details.
> I believe that this solution is secure because the private key password
> is never saved on the server. A hacker would have to gain access to an
> authorized user's PC to gain the password. I am not sure how difficult
> it is to crack a 256 bit private key with a 63 character pass. There is
> plenty of documentation on how hard it is to brute force the entire key,
> but not much I could find on the password.
Brute forcing a 63 character password is doable, although very time
consuming. For most e-commerce, I would say it's acceptable if there is
no other solution.
But are your users really going to enter a 63 character password? If no,
the password is shorter and easily brute forced. If yes, users will store
the password which can be regained by an attacker.
Here's an alternative.
- Don't store the private key on the server. Use the public key to
encrypt the card details.
- Every client gets a smartcard for the decryption (or a HSM, but those
are costly).
- Use a pin to protect the smartcard (commonly called a pin in the
context of smartcards, but often can actually be a pass phrase)
(actually, you use a pin to protect specific items on the card)
- Store the private key only on the smartcard. Make sure the key can only
be used for decryption and cannot be retrieved.
- Use an application client side to drive the smartcard (can be a Java
applet).
With this scheme, an attacker can crack the server, but cannot get at the
credit card details.
Why is this more secure?
- Private key gets only stored in smartcard, so -- if properly implemented
[2] -- impossible to copy.
- Brute forcing smartcard PINs is -- if properly implemented --
impossible. The card locks up after a number of wrong guesses.
- Man in the middle attacks are impossible.
- hacking the client computer does not immediately give an attacker full
access, he still needs a smartcard (if client is hacked, consider the PIN
compromised)
But this scheme has an obvious weakness. If a smartcard gets stolen,
together with the PIN, your borked. To get around that:
- If a smartcard gets missing/stolen, it must be reported immediately.
Draw up a contract that says the holder is responsible for damages
occurring through misuse of their card.
- Use a certificate per smartcard.
- The certificate gets stored on the server, together with a status flag
(inactive, active, stolen, revoked) (ldap is very good at storing
certificates).
- The private for the certificate key is stored on the smartcard,
protected by pin.
- This certificate is used to identify the client, so they don't have to
log on using user name+password (side effect, but makes it much more
useable for the client). Most (all?) webservers can do this very easily
and most (all?) webbrowsers support this.
- The certificate and private key are used to generate a session key. If
properly implemented, only the server and the smartcard know this key.
The client software doesn't know this key at all. However, you might want
to compromise here a bit.
- The encrypted credit card details are encrypted again by the server
with the session key and send to the client.
- The client uses the smartcard to decrypt the encrypted-encrypted credit
card details, then uses the smartcard again to decrypt the encrypted
details.
Why is this more secure than my first scenario?
- If a smartcard+PIN gets stolen, you have a fighting chance to revoke
the certificate before it is used.
However, this still leaves the attacker the possibility to crack the
server, get the single-encrypted details and use a stolen smartcard+pin
to decrypt the data. So the scheme should be enhanced:
- Protect the common private key not only by pin, but also by another
mechanism. The cards certificate should be presented to an authentication
server[1] (not the same server as the one storing the creditcard details)
which gives back a key (unique for that card) that can be used to unlock
the common private key. If you implement this you can even drop the pin
protecting the common private key.
Now an attacker has to hack two servers, and steal a smartcard+PIN.
(Aside from doing a lot of work once he has these).
[ Disclaimer, only thinking about this for an hour makes the above
suspect. I may very well have overlooked something, in fact I probably
have. I just want to give directions, but you have to learn to swim
yourself. ]
There is another scheme, less secure, but easier implemented.
- Again, use another authentication server. Use certificates for clients
to log into this server and set up a secure communication channel.
- The common private key is stored on this authentication server and send
to the client over this secured channel.
- Client uses private key to access credit card details.
HTH,
M4
[1] Authentication servers are easier to secure, but they should be very
secure. Use a dedicated server, behind a dedicated firewall. Pay
attention to physical access.
If you need to administer remotely: use a public/private key pair to
grant access, preferably using smartcards, and only from certain IPs.
[2] "If properly implemented" is actually quite hard to ascertain. Never
assume, test, test, test. Build specific testframeworks[3] to be sure.
Assumption is the mother....
[3] I once replaced the Windows smartcard DLL to see what went on under
the hood. Found one bit that was wrong, which made the whole security of
that application worthless. Luckily this was in the security testing
stage, so it could be rectified before deployment.
------------------------------
Date: Wed, 2 Jul 2008 11:45:33 -0700 (PDT)
From: onlineviewer <lancerset@gmail.com>
Subject: kill process when file number reached...
Message-Id: <8194d571-fcd3-4533-ace6-db31abc732bc@r66g2000hsg.googlegroups.com>
Hello All,
I am trying to run a tcpdump and have perl kill the tcpdump once 10
files have been created by the tcpdump. Here is my code, not sure...if
my logic is screwy
Thanks,
system "tcpdump -i bge1 -s0 -w /tmp/file.out -C 1";
sleep 2;
while(true){
@array1 = `ls -l /tmp | grep files`;
$result=@array1+1;
if ($result > 3){
$x=`ps -ef | awk '/tcpdump/ && !/awk/ {print
$2}'`;
@y=split(' ', $x);
$c=$y[1];
system "kill -9 $c";
print "killing tcpdump...";
}else{
print "!!!\n";
exit;
}
exit;
------------------------------
Date: Wed, 02 Jul 2008 15:04:25 -0400
From: smallpond <smallpond@juno.com>
Subject: Re: kill process when file number reached...
Message-Id: <5abe1$486bd148$11640@news.teranews.com>
onlineviewer wrote:
> Hello All,
>
> I am trying to run a tcpdump and have perl kill the tcpdump once 10
> files have been created by the tcpdump. Here is my code, not sure...if
> my logic is screwy
> Thanks,
>
> system "tcpdump -i bge1 -s0 -w /tmp/file.out -C 1";
> sleep 2;
>
> while(true){
> @array1 = `ls -l /tmp | grep files`;
> $result=@array1+1;
>
> if ($result > 3){
> $x=`ps -ef | awk '/tcpdump/ && !/awk/ {print
> $2}'`;
> @y=split(' ', $x);
> $c=$y[1];
> system "kill -9 $c";
> print "killing tcpdump...";
> }else{
> print "!!!\n";
> exit;
> }
> exit;
Why bother with perl? With the tcpdump command that you have, you
get about 100 bytes/packet. So if you want 10 x 1 MB, then you want
100,000 packets. -c 100000
** Posted from http://www.teranews.com **
------------------------------
Date: Wed, 2 Jul 2008 21:37:54 +0200
From: "Dr.Ruud" <rvtol+news@isolution.nl>
Subject: Re: looping issue
Message-Id: <g4gsg7.ko.1@news.isolution.nl>
Ben Morrow schreef:
> my $line = <$FILE> or last;
> chomp $line;
> my ($nusr_id) = split;
That split works on $_.
If you meant C<split "", $line;>, the preceding chomp is unnecessary.
--
Affijn, Ruud
"Gewoon is een tijger."
------------------------------
Date: Wed, 02 Jul 2008 13:01:36 +0300
From: Georgios Petasis <petasis@iit.demokritos.gr>
To: Leon Timmermans <fawaka@gmail.com>
Subject: Re: My c code has stopped working: PL_errgv NULL?
Message-Id: <486B5200.8090307@iit.demokritos.gr>
O/H Leon Timmermans έγραψε:
> On Tue, 01 Jul 2008 19:13:43 +0300, Georgios Petasis wrote:
>
>> O/H Leon Timmermans έγραψε:
>>
>>
>> Dear Leon,
>>
>> You can find the complete code at:
>> http://ellogon.svn.sourceforge.net/viewvc/ellogon/trunk/lib/tclperl-3.2/
> tclperl.c?revision=1&view=markup
>> Yes, I am using perl_parse():
>>
>> PERL_SET_CONTEXT(my_perl);
>> perl_construct(my_perl);
>> perl_parse(my_perl, xs_init, 3, embedded, 0); perl_run(my_perl);
>> eval_pv(code, 0);
>> SvTRUE(ERRSV); <- crash :-(
>>
>> Regards,
>>
>> George
>
> Hi,
>
> Can you check the value of PL_errgv directly after perl_parse() and
> perl_run() too?
>
> Leon
Dear Leon,
It is always NULL:
perl::interp new...
After perl_construct: PL_errgv: 00000000
After perl_parse: PL_errgv: 00000000
After perl_run: PL_errgv: 00000000
After eval_pv: PL_errgv: 00000000
How can this be possible? Am I doing anything wrong during compilation?
(I.e. have I missed any flags? I have used the output of "perl
-MExtUtils::Embed -e ccopts" to get the flags...)
Regards,
George
------------------------------
Date: Wed, 02 Jul 2008 13:10:54 +0200
From: Leon Timmermans <fawaka@gmail.com>
Subject: Re: My c code has stopped working: PL_errgv NULL?
Message-Id: <af230$486b623e$89e0e08f$16519@news2.tudelft.nl>
On Wed, 02 Jul 2008 13:01:36 +0300, Georgios Petasis wrote:
>
> Dear Leon,
>
> It is always NULL:
>
> perl::interp new...
> After perl_construct: PL_errgv: 00000000 After perl_parse: PL_errgv:
> 00000000
> After perl_run: PL_errgv: 00000000
> After eval_pv: PL_errgv: 00000000
>
> How can this be possible? Am I doing anything wrong during compilation?
> (I.e. have I missed any flags? I have used the output of "perl
> -MExtUtils::Embed -e ccopts" to get the flags...)
>
> Regards,
>
> George
Hi,
The value should be set during perl_parse(). Can you check the return
value of it? I think it should be zero (but it isn't documented properly,
so I'm not entirely sure).
Regards,
Leon
------------------------------
Date: Wed, 02 Jul 2008 14:37:20 +0300
From: Georgios Petasis <petasis@iit.demokritos.gr>
To: Leon Timmermans <fawaka@gmail.com>
Subject: Re: My c code has stopped working: PL_errgv NULL?
Message-Id: <486B6870.7080403@iit.demokritos.gr>
O/H Leon Timmermans έγραψε:
> On Wed, 02 Jul 2008 13:01:36 +0300, Georgios Petasis wrote:
>> Dear Leon,
>>
>> It is always NULL:
>>
>> perl::interp new...
>> After perl_construct: PL_errgv: 00000000 After perl_parse: PL_errgv:
>> 00000000
>> After perl_run: PL_errgv: 00000000
>> After eval_pv: PL_errgv: 00000000
>>
>> How can this be possible? Am I doing anything wrong during compilation?
>> (I.e. have I missed any flags? I have used the output of "perl
>> -MExtUtils::Embed -e ccopts" to get the flags...)
>>
>> Regards,
>>
>> George
>
> Hi,
>
> The value should be set during perl_parse(). Can you check the return
> value of it? I think it should be zero (but it isn't documented properly,
> so I'm not entirely sure).
>
> Regards,
>
> Leon
It is NULL (0).
George
------------------------------
Date: Wed, 2 Jul 2008 04:42:19 GMT
From: merlyn@stonehenge.com (Randal Schwartz)
Subject: new CPAN modules on Wed Jul 2 2008
Message-Id: <K3D3qJ.19v0@zorch.sf-bay.org>
The following modules have recently been added to or updated in the
Comprehensive Perl Archive Network (CPAN). You can install them using the
instructions in the 'perlmodinstall' page included with your Perl
distribution.
Algorithm-Evolutionary-0.60
http://search.cpan.org/~jmerelo/Algorithm-Evolutionary-0.60/
Perl extension for performing paradigm-free evolutionary algorithms.
----
Apache2-Translation-0.24
http://search.cpan.org/~opi/Apache2-Translation-0.24/
Configuring Apache dynamically
----
AudioFile-Info-MP3-ID3Lib-1.07
http://search.cpan.org/~davecross/AudioFile-Info-MP3-ID3Lib-1.07/
Perl extension to get info from MP3 files.
----
Auth-Yubikey_Decrypter-0.05
http://search.cpan.org/~massyn/Auth-Yubikey_Decrypter-0.05/
Decrypting the output from the yubikey token
----
Authen-SASL-2.12
http://search.cpan.org/~gbarr/Authen-SASL-2.12/
SASL Authentication framework
----
Autodia-2.08
http://search.cpan.org/~teejay/Autodia-2.08/
The configuration and Utility perl module for AutoDia.
----
Business-BR-Ids-0.0022
http://search.cpan.org/~ferreira/Business-BR-Ids-0.0022/
Modules for dealing with Brazilian identification codes (CPF, CNPJ, ...)
----
Business-OnlinePayment-Iridium-0.02
http://search.cpan.org/~wreis/Business-OnlinePayment-Iridium-0.02/
Iridium backend for Business::OnlinePayment
----
Config-Augeas-0.201
http://search.cpan.org/~ddumont/Config-Augeas-0.201/
Edit configuration files through Augeas C library
----
Config-Format-Ini-0.05
http://search.cpan.org/~ioannis/Config-Format-Ini-0.05/
Reads INI configuration files
----
DBIx-Class-DynamicDefault-0.01
http://search.cpan.org/~flora/DBIx-Class-DynamicDefault-0.01/
Automatically set and update fields
----
Digest-OAT-0.03
http://search.cpan.org/~mbailey/Digest-OAT-0.03/
Bob Jenkin's One-at-a-Time hash function
----
Email-Filter-Rules-1.2
http://search.cpan.org/~jbisbee/Email-Filter-Rules-1.2/
Simple Rules for Routing Mail with Email::Filter
----
Encode-2.26
http://search.cpan.org/~dankogai/Encode-2.26/
character encodings
----
Finance-DST-FAN-Mail-0.005000
http://search.cpan.org/~groditi/Finance-DST-FAN-Mail-0.005000/
Tools for interfacing with DST FAN Mail
----
FreeBSD-Pkgs-0.0.0
http://search.cpan.org/~vvelox/FreeBSD-Pkgs-0.0.0/
Reads the FreeBSD installed packaged DB.
----
Geo-Ellipsoid-1.11
http://search.cpan.org/~jgibson/Geo-Ellipsoid-1.11/
Calculate positions, distances, and bearings on the surface of an ellipsoid.
----
HTML-TurboForm-0.17
http://search.cpan.org/~camelcase/HTML-TurboForm-0.17/
----
HTML-WidgetValidator-Widget-PixivEmbedFeature-0.02
http://search.cpan.org/~pmint/HTML-WidgetValidator-Widget-PixivEmbedFeature-0.02/
Perl extension for validate "pixiv Embed"
----
HTML-WidgetValidator-Widget-PixivEmbedFeature-0.03
http://search.cpan.org/~pmint/HTML-WidgetValidator-Widget-PixivEmbedFeature-0.03/
Perl extension for validate "pixiv Embed"
----
HTTP-Engine-0.0.12
http://search.cpan.org/~yappo/HTTP-Engine-0.0.12/
Web Server Gateway Interface and HTTP Server Engine Drivers (Yet Another Catalyst::Engine)
----
IPC-Locker-1.482
http://search.cpan.org/~wsnyder/IPC-Locker-1.482/
Distributed lock handler
----
IPTables-libiptc-0.10
http://search.cpan.org/~hawk/IPTables-libiptc-0.10/
Perl extension for iptables libiptc
----
JavaScript-XRay-1.22
http://search.cpan.org/~jbisbee/JavaScript-XRay-1.22/
See What JavaScript is Doing
----
Lingua-PT-PLN-0.14
http://search.cpan.org/~jjoao/Lingua-PT-PLN-0.14/
Perl extension for NLP of the Portuguese Language
----
Lingua-PT-PLN-0.15
http://search.cpan.org/~jjoao/Lingua-PT-PLN-0.15/
Perl extension for NLP of the Portuguese Language
----
Muldis-D-0.38.0
http://search.cpan.org/~duncand/Muldis-D-0.38.0/
Formal spec of Muldis D relational DBMS lang
----
Net-BitTorrent-0.023_002
http://search.cpan.org/~sanko/Net-BitTorrent-0.023_002/
BitTorrent peer-to-peer protocol class
----
Net-BitTorrent-0.024
http://search.cpan.org/~sanko/Net-BitTorrent-0.024/
BitTorrent peer-to-peer protocol class
----
OpenResty-0.3.7
http://search.cpan.org/~agent/OpenResty-0.3.7/
General-purpose web service platform for web applications
----
POE-Component-RSSAggregator-1.1
http://search.cpan.org/~jbisbee/POE-Component-RSSAggregator-1.1/
Watch Muliple RSS Feeds for New Headlines
----
POE-Component-Server-Daytime-1.12
http://search.cpan.org/~bingos/POE-Component-Server-Daytime-1.12/
A POE component that implements an RFC 867 Daytime server.
----
POE-Component-Server-Discard-1.12
http://search.cpan.org/~bingos/POE-Component-Server-Discard-1.12/
A POE component that implements an RFC 863 Discard server.
----
POE-Component-Server-Ident-1.14
http://search.cpan.org/~bingos/POE-Component-Server-Ident-1.14/
A POE component that provides non-blocking ident services to your sessions.
----
POE-Component-Server-Qotd-1.12
http://search.cpan.org/~bingos/POE-Component-Server-Qotd-1.12/
A POE component that implements an RFC 865 QotD server.
----
POE-Component-Server-SimpleContent-1.12
http://search.cpan.org/~bingos/POE-Component-Server-SimpleContent-1.12/
The easy way to serve web content with POE::Component::Server::SimpleHTTP.
----
POE-Component-Server-Time-1.12
http://search.cpan.org/~bingos/POE-Component-Server-Time-1.12/
A POE component that implements an RFC 868 Time server.
----
POE-Filter-Bzip2-1.58
http://search.cpan.org/~bingos/POE-Filter-Bzip2-1.58/
A POE filter wrapped around Compress::Bzip2
----
Parse-Marpa-0.211_010
http://search.cpan.org/~jkegl/Parse-Marpa-0.211_010/
Earley's algorithm with LR(0) precomputation
----
REST-Google-1.0.4
http://search.cpan.org/~ejs/REST-Google-1.0.4/
access Google REST (aka AJAX) API from Perl
----
Rubric-0.143
http://search.cpan.org/~rjbs/Rubric-0.143/
a notes and bookmarks manager with tagging
----
Scalar-Defer-0.16
http://search.cpan.org/~audreyt/Scalar-Defer-0.16/
Lazy evaluation in Perl
----
Set-IntSpan-Fast-1.14
http://search.cpan.org/~andya/Set-IntSpan-Fast-1.14/
Fast handling of sets containing integer spans.
----
Set-IntSpan-Fast-XS-0.04
http://search.cpan.org/~andya/Set-IntSpan-Fast-XS-0.04/
Faster Set::IntSpan::Fast
----
Test-Classy-0.01
http://search.cpan.org/~ishigaki/Test-Classy-0.01/
write your unit tests in other modules than *.t
----
Test-POE-Client-TCP-0.06
http://search.cpan.org/~bingos/Test-POE-Client-TCP-0.06/
A POE Component providing TCP client services for test cases
----
Test-TempDir-0.04
http://search.cpan.org/~nuffin/Test-TempDir-0.04/
Temporary files support for testing.
----
Tie-Expression-0.01
http://search.cpan.org/~dankogai/Tie-Expression-0.01/
Let any %hash interpolate any expression.
----
Win32-SharedFileOpen-3.37
http://search.cpan.org/~shay/Win32-SharedFileOpen-3.37/
Open a file for shared reading and/or writing
----
Win32-UTCFileTime-1.47
http://search.cpan.org/~shay/Win32-UTCFileTime-1.47/
Get/set UTC file times with stat/utime on Win32
----
X3D-Values-Int32-0.002_001
http://search.cpan.org/~hooo/X3D-Values-Int32-0.002_001/
Perl extension for blah blah blah
----
XML-RSS-Feed-2.31
http://search.cpan.org/~jbisbee/XML-RSS-Feed-2.31/
Persistant XML RSS Encapsulation
----
Yahoo-Marketing-4.05
http://search.cpan.org/~shenj/Yahoo-Marketing-4.05/
an interface for Yahoo! Search Marketing's Web Services.
If you're an author of one of these modules, please submit a detailed
announcement to comp.lang.perl.announce, and we'll pass it along.
This message was generated by a Perl program described in my Linux
Magazine column, which can be found on-line (along with more than
200 other freely available past column articles) at
http://www.stonehenge.com/merlyn/LinuxMag/col82.html
print "Just another Perl hacker," # the original
--
Randal L. Schwartz - Stonehenge Consulting Services, Inc. - +1 503 777 0095
<merlyn@stonehenge.com> <URL:http://www.stonehenge.com/merlyn/>
Smalltalk/Perl/Unix consulting, Technical writing, Comedy, etc. etc.
See http://methodsandmessages.vox.com/ for Smalltalk and Seaside discussion
------------------------------
Date: Tue, 01 Jul 2008 18:20:51 -0700
From: -linux_lad <john@linuxNOSPAMlad.org>
Subject: Re: RSA implementation, please comment.
Message-Id: <Z6qdnVj62txpSvfVnZ2dnUVZ_qHinZ2d@giganews.com>
Rob wrote:
> Hi All;
> I've come up with a solution and I'd like some feedback on whether or
> not it is secure.
>
> SYNOPSIS: Is Crypt::RSA secure acceptable in open source if the
> private key password is in a browser cookie?
>
> DETAILS:
> We're running a pretty basic LAMPS system with MySQL 5.1 and Perl 5.8.
> The client asked me to devise "a secure way to save credit card
> numbers in the sales database". Every paper I've read recommends
> saving the card numbers off site or not at all, but in this case the
> the client is a middle-man who collects the sales information
> (including card numbers) in one place, and needs to pull up the entire
> customer record including card data in a back-office setting using a
> secure server.
>
> Most encryption and decryption schemas I came up with had the same
> problem -- open source.
I don't know if I can talk you out of keeping the card numbers on the
same server but I'm going to try. A dedicated server can be leased for a
hundred dollars a month. There is no legitimate excuse for keeping the
numbers on a server which is accessible by a web browser. Servers are
compromised despite the best intentions of the server admins. If the web
server were ever compromised it could be a disaster for your client. The
256 bit RSA key could be factored in hours. You would need a much larger
key for it to be secure.
If you must store the data on the same web server, then you are better
off generating an encryption key from a good quality random number
generator and using a two way algorithm like RC4 (very fast encryption,
BTW). The random number generator will return the same string if the
seed is the same. You will get the seed from a hash of a concatenation
of the username, email address, phone number, user's password (you will
have in in plain text from the form, but store encrypted or hashed),
etc. Cat all those strings in any order you want, pass it through SHA512
or somesuch, and pass the resulting string to your RNG. Poof, out comes
your password, for that user only.
Don't store the expiration or CCV/CCV2.
--
-linux_lad
------------------------------
Date: Wed, 2 Jul 2008 09:16:31 +0200
From: Martijn Lievaart <m@rtij.nl.invlalid>
Subject: Re: RSA implementation, please comment.
Message-Id: <pan.2008.07.02.07.16.31@rtij.nl.invlalid>
On Tue, 01 Jul 2008 17:24:08 -0700, Rob wrote:
> Hi All;
> I've come up with a solution and I'd like some feedback on whether or
> not it is secure.
Besides not being terribly secure, but also not terribly insecure, I see
one fatal flaw in your plan. How is the client going to use the private
key? As I read it, you are going to use javascript. I think you'll find
that opening the key will take forever and using it even longer.
Replace the client side with a Java applet or application and the whole
thing becomes much more viable.
M4
------------------------------
Date: Wed, 02 Jul 2008 12:38:23 +0200
From: Leon Timmermans <fawaka@gmail.com>
Subject: Re: RSA implementation, please comment.
Message-Id: <92397$486b5a9f$89e0e08f$16519@news2.tudelft.nl>
On Tue, 01 Jul 2008 18:20:51 -0700, -linux_lad wrote:
> Rob wrote:
> If you must store the data on the same web server, then you are better
> off generating an encryption key from a good quality random number
> generator and using a two way algorithm like RC4 (very fast encryption,
> BTW).
RC4 has serious security issues, see Wikipedia for more information on
them.
Leon
------------------------------
Date: Tue, 01 Jul 2008 21:56:58 -0400
From: John W Kennedy <jwkenne@attglobal.net>
Subject: Re: The Importance of Terminology's Quality
Message-Id: <486ae06b$0$5011$607ed4bc@cv.net>
Robert Maas, http://tinyurl.com/uh3t wrote:
> Why this response is so belated:
> <http://groups.google.com/group/misc.misc/msg/cea714440e591dd2>
> = <news:rem-2008jun25-003@yahoo.com>
>> Date: Tue, 24 Jun 2008 18:42:15 -0400
>> From: John W Kennedy <jwke...@attglobal.net>
>> ... the "thunks" were necessary at the machine-language level to
>> /implement/ ALGOL 60, but they could not be expressed /in/ ALGOL.
>
> Ah, thanks for the clarification. Is that info in the appropriate
> WikiPedia page? If not, maybe you would edit it in?
It is explained s.v. "thunk", which is referenced from "ALGOL 60". The
ALGOL "pass-by-name" argument/parameter matching was perhaps the most
extreme example ever of a language feature that was "elegant" but
insane. What it meant, in effect, was that, unless otherwise marked,
every argument was passed as two closures, one that returned a fresh
evaluation of the expression given as the argument, which was called
every time the parameter was read, and one that set the argument to a
new value, which was called every time the parameter was set.
See <URL:http://www.cs.sfu.ca/~cameron/Teaching/383/PassByName.html>.
ALGOL 60 could not create generalized user-written closures, but could
create one no more complex than a single expression with no arguments of
its own simply by passing the expression as an argument. But it was not
thought of as a closure; that was just how ALGOL 60 did arguments.
--
John W. Kennedy
"Give up vows and dogmas, and fixed things, and you may grow like
That. ...you may come to think a blow bad, because it hurts, and not
because it humiliates. You may come to think murder wrong, because it
is violent, and not because it is unjust."
-- G. K. Chesterton. "The Ball and the Cross"
------------------------------
Date: 6 Apr 2001 21:33:47 GMT (Last modified)
From: Perl-Users-Request@ruby.oce.orst.edu (Perl-Users-Digest Admin)
Subject: Digest Administrivia (Last modified: 6 Apr 01)
Message-Id: <null>
Administrivia:
#The Perl-Users Digest is a retransmission of the USENET newsgroup
#comp.lang.perl.misc. For subscription or unsubscription requests, send
#the single line:
#
# subscribe perl-users
#or:
# unsubscribe perl-users
#
#to almanac@ruby.oce.orst.edu.
NOTE: due to the current flood of worm email banging on ruby, the smtp
server on ruby has been shut off until further notice.
To submit articles to comp.lang.perl.announce, send your article to
clpa@perl.com.
#To request back copies (available for a week or so), send your request
#to almanac@ruby.oce.orst.edu with the command "send perl-users x.y",
#where x is the volume number and y is the issue number.
#For other requests pertaining to the digest, send mail to
#perl-users-request@ruby.oce.orst.edu. Do not waste your time or mine
#sending perl questions to the -request address, I don't have time to
#answer them even if I did know the answer.
------------------------------
End of Perl-Users Digest V11 Issue 1686
***************************************
