Google considered the possibility of creating its own currency called Google Bucks.. Eric Schmidt.. at Mobile World Congress in Barcelona on Tuesday.
“peer-to-peer” money system ..transfer cash to each other ..
the project was eventually nixed because of the various laws about currency
The concept would also make it easier for potential money laundering scandals. [confused journalese? easier scandals?]
..we didn’t want to get into that because of these issues,” Schmidt ..
digitaltrends
Google launched its e-Wallet, which comes with a prepaid card that you can top up from your bank account or credit card to pay for goods.
______________________________________________________
Myki
Queues grow as bugs plague new $1.35 billion myki system
With two weeks until weekly and monthly Metcards become extinct..
Metcard machines have started being pulled out of stations in Melbourne's west.
Daniel Bowen of the Public Transport Users Association said the readers worked most of the time ..
More than a third of commuters now used myki. heraldsun
__________________________________________________________
how to get it right, such as London’s Oyster and Singapore’s EZ-Link smartcards, and one close to home: Perth’s SmartRider wordpress zdnet
An error in Victoria's recently implemented Myki smart card system has seen two customers credited over $150,000 to their accounts.
why-transport-smart-card-projects-go-bad zdnet
_______________________________________________________
The Bank of Tanzania (BoT) has drafted mobile payment regulations ..
..February report, registered customers for mobile financial services 19.4 million November 2011, compared to 14,327 June 2008.
alue of transactions increased from TZS 1.42 million in 2007 to TZS 1.62 trillion in 2011,
trust accounts to facilitate transactions from TZS 3.04 billion in June 2009 to TZS 97.6 billion at end of 2011.
E Fulusi (T) pioneered 2008 M-Pesa started four service providers Vodacom (M-Pesa), Airtel (Airtel Money), Tigo (Tigo Pesa), and Zantel (Ezy-Pesa). telecompaper
E-Fulusi mobile wallet technology currently powers the Mobipawa and ZPESA services, the first two mobile banking services in Tanzania.
_____________________________________________________________________
14 March 2012
06 March 2012
XML Canonicalizer
When signing an XML file, obviously all need to agree on "proper" form
so use a canonicalizer
Java doesnt have one, so use apache rather than sun
-so far I have included all the apache xml jars, ... several at least are required
public static String canon (String raw)
{
String cooked = null;
try
{
byte inputBytes[] = raw.getBytes();
org.apache.xml.security.c14n.Canonicalizer c14n = Canonicalizer.getInstance(Canonicalizer.ALGO_ID_C14N_OMIT_COMMENTS);
byte result[] = c14n.canonicalize(inputBytes);
cooked = new String(result);
}
catch (Exception ex)
{
print("\n canon excptn " + ex.getMessage());
print("\n raw " + raw + "\n");
}
return cooked;
However this doesnt seem to do much:
raw
<dc:FileDataCollection xmlns:dc="http://www.fredrick.dc" xmlns:dca="http://www.fredrick.dc/AuditRegisters" xmlns:dce="http://www.fredrick.dc/Events" xmlns:dct="http://www.fredrick.dc/Transactions" xmlns:dcv="http://www.fredrick.dc/Versions" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<FileHeader >
<FileHeaderTag> FHTAG_EVENT_LOG</FileHeaderTag >
<FileCreationDate>2012-02-21T15:45:55</FileCreationDate>
<SignKeyVer>0</SignKeyVer>
</FileHeader>
<FileBody>
<FileMessage>
<MsgHeader>
<MsgSequenceNumber></MsgSequenceNumber>
<MsgReportDate>2012-02-21T15:45:55</MsgReportDate>
<DeviceID>65537</DeviceID>
<ComplementDeviceID>0</ComplementDeviceID>
=======================================
cooked Canonical
<dc:FileDataCollection xmlns:dc="http://www.fredrick.dc" xmlns:dca="http://www.fredrick.dc/AuditRegisters" xmlns:dce="http://www.fredrick.dc/Events" xmlns:dct="http://www.fredrick.dc/Transactions" xmlns:dcv="http://www.fredrick.dc/Versions" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<FileHeader>
<FileHeaderTag> FHTAG_EVENT_LOG</FileHeaderTag> indent spaces same, spaces in tag removed
<FileCreationDate>2012-02-21T15:45:55</FileCreationDate>
<SignKeyVer>0</SignKeyVer>
</FileHeader>
<FileBody>
<FileMessage>
<MsgHeader>
<MsgSequenceNumber></MsgSequenceNumber> empty tag left
line-seperator is LF 0x0A, no CR which is handy
The Client has sent me some demo XML signed files: the certificate is OK, has an OK public key, which verifies the Signature to a decent Digest. BUT the plaintext Digest is different!
One at least, probably both, have been cobbled together. And no SHA1 digest of a range of versions of the raw input produce a digest identical to either of the 2 received. Aint adversarial business grand!
so use a canonicalizer
Java doesnt have one, so use apache rather than sun
-so far I have included all the apache xml jars, ... several at least are required
public static String canon (String raw)
{
String cooked = null;
try
{
byte inputBytes[] = raw.getBytes();
org.apache.xml.security.c14n.Canonicalizer c14n = Canonicalizer.getInstance(Canonicalizer.ALGO_ID_C14N_OMIT_COMMENTS);
byte result[] = c14n.canonicalize(inputBytes);
cooked = new String(result);
}
catch (Exception ex)
{
print("\n canon excptn " + ex.getMessage());
print("\n raw " + raw + "\n");
}
return cooked;
However this doesnt seem to do much:
raw
<dc:FileDataCollection xmlns:dc="http://www.fredrick.dc" xmlns:dca="http://www.fredrick.dc/AuditRegisters" xmlns:dce="http://www.fredrick.dc/Events" xmlns:dct="http://www.fredrick.dc/Transactions" xmlns:dcv="http://www.fredrick.dc/Versions" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<FileHeader >
<FileHeaderTag> FHTAG_EVENT_LOG</FileHeaderTag >
<FileCreationDate>2012-02-21T15:45:55</FileCreationDate>
<SignKeyVer>0</SignKeyVer>
</FileHeader>
<FileBody>
<FileMessage>
<MsgHeader>
<MsgSequenceNumber></MsgSequenceNumber>
<MsgReportDate>2012-02-21T15:45:55</MsgReportDate>
<DeviceID>65537</DeviceID>
<ComplementDeviceID>0</ComplementDeviceID>
=======================================
cooked Canonical
<dc:FileDataCollection xmlns:dc="http://www.fredrick.dc" xmlns:dca="http://www.fredrick.dc/AuditRegisters" xmlns:dce="http://www.fredrick.dc/Events" xmlns:dct="http://www.fredrick.dc/Transactions" xmlns:dcv="http://www.fredrick.dc/Versions" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<FileHeader>
<FileHeaderTag> FHTAG_EVENT_LOG</FileHeaderTag> indent spaces same, spaces in tag removed
<FileCreationDate>2012-02-21T15:45:55</FileCreationDate>
<SignKeyVer>0</SignKeyVer>
</FileHeader>
<FileBody>
<FileMessage>
<MsgHeader>
<MsgSequenceNumber></MsgSequenceNumber> empty tag left
line-seperator is LF 0x0A, no CR which is handy
The Client has sent me some demo XML signed files: the certificate is OK, has an OK public key, which verifies the Signature to a decent Digest. BUT the plaintext Digest is different!
One at least, probably both, have been cobbled together. And no SHA1 digest of a range of versions of the raw input produce a digest identical to either of the 2 received. Aint adversarial business grand!
28 February 2012
Security Misc.
Some Security items:
Redphone 0.4 removed from AndroidApps, beta may be available..
Redphone uses ZRTP, Diffie-Hellman key exchange and the Secure Real-time Transport Protocol (SRTP) for encryption.
..ZRTP designed by Phillip Zimmerman, the inventor of PGP
Download free from Android market
RedPhone 0.4
..need someone to call, join #whispersystems on irc.freenode.net
.._________________________________
Moxie Marlinspike, was met by two U.S. Customs and Border Protection agents at the door of his plane when he arrived at JFK airport on a Jet Blue flight from the Dominican Republic. ..held him for 4 1/2 hours,..seized Marlinspike’s laptop and two cellphones, and asked for his passwords..
Marlinspike refused, and the devices were later returned to him.
“I can’t trust any of these devices now,”.. “They could have modified the hardware or installed new keyboard firmware.”
Marlinspike gained attention last year at the Black Hat security conference in Las Vegas when he revealed a serious vulnerability in how internet browsers verify digital security certificates. ..He released two free tools that would help an attacker conduct such an attack.
Three months later, PayPal froze his account
.....ticket agents, .. were blocked from producing a boarding pass for him without first calling .. Department of Homeland Security. Secure Flight .....
Others.....
security researcher Jake Appelbaum, was detained in July at a New Jersey airport,..on his way to the DefCon hacker conference ..a U.S. rep for WikiLeaks, was questioned ..three-hour period about WikiLeaks,..Julian Assange and Appelbaum’s opinion about the wars in Iraq and Afghanistan.
...David House was met by U.S. customs agents as he deplaned earlier this month at Chicago’s O’Hare ..from Mexico....had his laptop seized
..House helped set up the Bradley Manning Support Network, ..
wired
___________________________________________________________________
5 for SMS
whispersys has no downloads .. just points to Android MArket
Beta may be here try
brothersoft
Phones on which beta may work
brothersoft
____________________________________________________________________________________________
Code signing FAQs available at:
thawte
- Hey lets send Shuttleworth into space AGAIN (just kidding, and thanks for all the Ubuntu)
____________________________________________________________________________________________
Leap card, 10 years late and €26m over budget.( sounds fairly typical)
It allows Dublin commuters to top up on credit in advance and then swipe it for cheaper fares on trains, buses and trams. (this is a feature, , surely, not a bug)
..Irish Independent reveal for the first time how a host of companies benefited from repeated delays in the project, which pushed costs up from €29.6m to €55.4m. (the ii article reveals typical incompetence, not malicious delaying??)
__________________________________________________
AdMob, Mobclix, InMobi, etc. can pillage all sorts of information from unsuspecting users. Users will blame you, not the advertising company
__________________________________
Stuxnet video
digitalbond c/o Bruce Schneier schneier
__________________________________
Some Security puff :
The BIG-IP Edge Client app provides not only full SSL VPN access from iPhones and
iPads,
Center for Information Security (http://www.cisecurity.org) offers
a multipoint checklist that includes implementing Network Intrusion Detection.. load-balancing/failover to combat
Denial of Service or shutdown...sterilize WHOIS records of personal information that can be used for social
engineering ..Open Web Applications Security Project’s (OWASP –
http://www.owasp.org) AppSec tutorial series ..hardening Apache. M.. http://xianshield.org/guides/apache2.0guide.html).
..separate partitions for binaries, html documents and logs, ..
Apache in its own, nonprivileged group (i.e. not nobody), removing its shell and locking its login.
__________________________________
Redphone 0.4 removed from AndroidApps, beta may be available..
Redphone uses ZRTP, Diffie-Hellman key exchange and the Secure Real-time Transport Protocol (SRTP) for encryption.
..ZRTP designed by Phillip Zimmerman, the inventor of PGP
Download free from Android market
RedPhone 0.4
UPS! APP NOT FOUND
That app seems to be not longer available on Android Market.
..need someone to call, join #whispersystems on irc.freenode.net
.._________________________________
Airport woes
Moxie Marlinspike, was met by two U.S. Customs and Border Protection agents at the door of his plane when he arrived at JFK airport on a Jet Blue flight from the Dominican Republic. ..held him for 4 1/2 hours,..seized Marlinspike’s laptop and two cellphones, and asked for his passwords..
Marlinspike refused, and the devices were later returned to him.
“I can’t trust any of these devices now,”.. “They could have modified the hardware or installed new keyboard firmware.”
Marlinspike gained attention last year at the Black Hat security conference in Las Vegas when he revealed a serious vulnerability in how internet browsers verify digital security certificates. ..He released two free tools that would help an attacker conduct such an attack.
Three months later, PayPal froze his account
.....ticket agents, .. were blocked from producing a boarding pass for him without first calling .. Department of Homeland Security. Secure Flight .....
Others.....
security researcher Jake Appelbaum, was detained in July at a New Jersey airport,..on his way to the DefCon hacker conference ..a U.S. rep for WikiLeaks, was questioned ..three-hour period about WikiLeaks,..Julian Assange and Appelbaum’s opinion about the wars in Iraq and Afghanistan.
...David House was met by U.S. customs agents as he deplaned earlier this month at Chicago’s O’Hare ..from Mexico....had his laptop seized
..House helped set up the Bradley Manning Support Network, ..
wired
___________________________________________________________________
5 for SMS
whispersys has no downloads .. just points to Android MArket
Beta may be here try
brothersoft
Phones on which beta may work
brothersoft
____________________________________________________________________________________________
Code signing FAQs available at:
thawte
- Hey lets send Shuttleworth into space AGAIN (just kidding, and thanks for all the Ubuntu)
____________________________________________________________________________________________
Slow trains?
Australian firm Sequoia Smart Solutions [Freemantle?] €5m for designing the smart- card system. (not a huge amount?)Leap card, 10 years late and €26m over budget.( sounds fairly typical)
It allows Dublin commuters to top up on credit in advance and then swipe it for cheaper fares on trains, buses and trams. (this is a feature, , surely, not a bug)
..Irish Independent reveal for the first time how a host of companies benefited from repeated delays in the project, which pushed costs up from €29.6m to €55.4m. (the ii article reveals typical incompetence, not malicious delaying??)
__________________________________________________
AdMob, Mobclix, InMobi, etc. can pillage all sorts of information from unsuspecting users. Users will blame you, not the advertising company
__________________________________
Stuxnet video
digitalbond c/o Bruce Schneier schneier
__________________________________
Some Security puff :
The BIG-IP Edge Client app provides not only full SSL VPN access from iPhones and
iPads,
Center for Information Security (http://www.cisecurity.org) offers
a multipoint checklist that includes implementing Network Intrusion Detection.. load-balancing/failover to combat
Denial of Service or shutdown...sterilize WHOIS records of personal information that can be used for social
engineering ..Open Web Applications Security Project’s (OWASP –
http://www.owasp.org) AppSec tutorial series ..hardening Apache. M.. http://xianshield.org/guides/apache2.0guide.html).
..separate partitions for binaries, html documents and logs, ..
Apache in its own, nonprivileged group (i.e. not nobody), removing its shell and locking its login.
__________________________________
Certificate and Schlumberger Cryptoflex PKI card
re Schlumberger Cryptoflex PKI card
We have the CHVS, its all good.
BTW dont read the public key, do the correct thing and read the certificate, then get the public key from the certificate.
And to send the certificate, dont use certificate.toString
as the helpful forums.oracle say
.."Don't do that. Use the getEncoded() method, and at the receiving end feed that to a CertificateFactory. Depending on your transport you might also need base64-encoding."
...
Just to complete the story: to get a certificate back from encoded byte array:
and the base64 stuff:
To convert X509 certificate to base64 string:
byte[] bCert = certificate.getEncoded();
String sCert = XML extract the X509Certificate object...
byte[] bencoded = javax.xml.bind.DatatypeConverter.parseBase64Binary(sCert); // Converts the string argument into an array of bytes.
We have the CHVS, its all good.
BTW dont read the public key, do the correct thing and read the certificate, then get the public key from the certificate.
And to send the certificate, dont use certificate.toString
as the helpful forums.oracle say
.."Don't do that. Use the getEncoded() method, and at the receiving end feed that to a CertificateFactory. Depending on your transport you might also need base64-encoding."
...
Just to complete the story: to get a certificate back from encoded byte array:
ByteArrayInputStream bisb = new ByteArrayInputStream(encodedBytes);
CertificateFactory cfb = CertificateFactory.getInstance("X.509");
X509Certificate certb = (X509Certificate)cfb.generateCertificate(bisb);
bisb.close();
print(" X509 back again " + certb.getSigAlgName() );and the base64 stuff:
To convert X509 certificate to base64 string:
byte[] bCert = certificate.getEncoded();
String sCert = javax.xml.bind.DatatypeConverter.printBase64Binary(bcert);
And to convert back: String sCert = XML extract the X509Certificate object...
byte[] bencoded = javax.xml.bind.DatatypeConverter.parseBase64Binary(sCert); // Converts the string argument into an array of bytes.
02 February 2012
Schlumberger Smart Card Toolkit
Schlumberger Smart Card Toolkit
Where is the toolkit?
Google search just brings up a bunch of damned fool intermediate sites,
such as 'software.informer' - blatent parasites on the information body
Where is the toolkit?
Google search just brings up a bunch of damned fool intermediate sites,
such as 'software.informer' - blatent parasites on the information body
01 February 2012
Cryptoflex AAK
Schlumberger Cryptoflex PKI card
( probably 32K e-Gate)
the documentation is available at
polman
... mentions a transpoprt key AAK 2C15E526E93E8A19
nabble
suggests the Cryptoflex
Initial Application authorization key (AAK), also called the transport key:2C15E526E93E8A19
will also act as CHV1 (User Authorisation key)
I used one attempt and got a fail with this key
[the "attempts remaining" byte went from hex 83 to hex 82]
so I await the (mystery) supplier of this card to supply me with a good CHV1
Files, such the RSA public key files, dont appear to report their lengths,
or key sizes, So I guess I'll trial& error from 2048 down...
..
( probably 32K e-Gate)
the documentation is available at
polman
... mentions a transpoprt key AAK 2C15E526E93E8A19
nabble
suggests the Cryptoflex
Initial Application authorization key (AAK), also called the transport key:2C15E526E93E8A19
will also act as CHV1 (User Authorisation key)
I used one attempt and got a fail with this key
[the "attempts remaining" byte went from hex 83 to hex 82]
so I await the (mystery) supplier of this card to supply me with a good CHV1
Files, such the RSA public key files, dont appear to report their lengths,
or key sizes, So I guess I'll trial& error from 2048 down...
..
30 December 2011
CUDA at last
CUDA installed, on a recent attempt
- it does work, there's a nice Mandelbrot demo...
I'm interested in Big Integers. Its not clear how much CUDA speeds these up
NVIDIA GPUs have a bunch of floating point multipliers, not a natural fit for integer MUL with carry
Reports vary from "2X" to "order of magnitude" faster on factoring big integers
nvidia
Obviously with just a laptop and a GT525M, I cant be serious about doing big Integer stuff at a competitive level
- but I'm just curious...
Way back, I wrote 386 Assembler code Miller-Rabin Prime tests and a bunch of functions
(Kuttaka.exe, it must be out there )
Occasionally I get a hankering to do big Integers once more
Computers are a million times faster now, they say
GMP is the famous bigInteger library now, buts uses gcc, anti-windows,
a bitch, Even if you go Linux dual boot, you just know that gcc is gonna throw some bunch of errors
a factoring program YAFU bbuhrow
- This apparently uses GMP but the exe runs ootb on Windows.
nice functions like "nextprime"
factored an 80 digit decimal in 4 minutes (Quadratic sieve?)
I want to use my GPU, so I downloaded
msieve from gilchrist this is "Jeff" who people on http://www.mersenneforum.org/ are often thanking
the cuda version
the win32 version worked (factored the 80 digit in 4 minutes)
18/06/2011 02:07 p.m. 870,912 msieve.exe
but the NVIDIA utility reported GPU activity 'none'
tried the big win64 version but got
"vcomp100.dll is missing" - some cuda 64/32 bit mismatch
- not fixed by reloading directX, nor by scattering vcomp100.dll or cudart.dll about
17/06/2011 09:23 p.m. 1,171,968 msieve.exe CUDA confusion?
I may post a complaint on
mersenneforum
but as of now I dont have any idea if my GPU is active or effective
there is a Number-Field-Sieve implementation CGNFS (from Jeff)
- requires Python 2.6 which is worth having anyway.
I overwrote with the win32 version of msieve and tried the 80 digit using factMsieve.py
- it chugged away for half an hour? then crashed
At the moment I am trying CGNFS on their 100 digit example - hasnt crashed, is onto the sieve
- from the forum it seems its all about tweaking parameters
mpir
MPIR is a fork from GMP
MPIR may be Non-anti-windows and may even be faster
I havnt looked to see if has a library for VC++
do I still have the level of obsession required ?...
It was oddly nostalgic to look up an article and realise I had tinkered with its algorithms
back in the 90s
- it does work, there's a nice Mandelbrot demo...
I'm interested in Big Integers. Its not clear how much CUDA speeds these up
NVIDIA GPUs have a bunch of floating point multipliers, not a natural fit for integer MUL with carry
Reports vary from "2X" to "order of magnitude" faster on factoring big integers
nvidia
NVIDIA Corporation\NVIDIA GPU Computing SDK 4.0\C\bin\win64\Release\bandwidthTest.exe Starting......
Running on...
Device 0: GeForce GT 525M
Quick Mode
Host to Device Bandwidth, 1 Device(s), Paged memory
Transfer Size (Bytes) Bandwidth(MB/s)
33554432 2330.7
,,,
NVIDIA Corporation\NVIDIA GPU Computing SDK 4.0\C\bin\win64\Release\deviceQuery.exe Starting...
CUDA Device Query (Runtime API) version (CUDART static linking)
Found 1 CUDA Capable device(s)
Device 0: "GeForce GT 525M"
CUDA Driver Version / Runtime Version 4.0 / 4.0
CUDA Capability Major/Minor version number: 2.1
Total amount of global memory: 962 MBytes (1008402432 bytes)
( 2) Multiprocessors x (48) CUDA Cores/MP: 96 CUDA Cores
GPU Clock Speed: 1.20 GHz
Obviously with just a laptop and a GT525M, I cant be serious about doing big Integer stuff at a competitive level
- but I'm just curious...
Way back, I wrote 386 Assembler code Miller-Rabin Prime tests and a bunch of functions
(Kuttaka.exe, it must be out there )
Occasionally I get a hankering to do big Integers once more
Computers are a million times faster now, they say
GMP is the famous bigInteger library now, buts uses gcc, anti-windows,
a bitch, Even if you go Linux dual boot, you just know that gcc is gonna throw some bunch of errors
a factoring program YAFU bbuhrow
- This apparently uses GMP but the exe runs ootb on Windows.
nice functions like "nextprime"
factored an 80 digit decimal in 4 minutes (Quadratic sieve?)
I want to use my GPU, so I downloaded
msieve from gilchrist this is "Jeff" who people on http://www.mersenneforum.org/ are often thanking
the cuda version
the win32 version worked (factored the 80 digit in 4 minutes)
18/06/2011 02:07 p.m. 870,912 msieve.exe
but the NVIDIA utility reported GPU activity 'none'
tried the big win64 version but got
"vcomp100.dll is missing" - some cuda 64/32 bit mismatch
- not fixed by reloading directX, nor by scattering vcomp100.dll or cudart.dll about
17/06/2011 09:23 p.m. 1,171,968 msieve.exe CUDA confusion?
I may post a complaint on
mersenneforum
but as of now I dont have any idea if my GPU is active or effective
there is a Number-Field-Sieve implementation CGNFS (from Jeff)
- requires Python 2.6 which is worth having anyway.
I overwrote with the win32 version of msieve and tried the 80 digit using factMsieve.py
- it chugged away for half an hour? then crashed
At the moment I am trying CGNFS on their 100 digit example - hasnt crashed, is onto the sieve
- from the forum it seems its all about tweaking parameters
mpir
MPIR is a fork from GMP
MPIR may be Non-anti-windows and may even be faster
I havnt looked to see if has a library for VC++
do I still have the level of obsession required ?...
It was oddly nostalgic to look up an article and realise I had tinkered with its algorithms
back in the 90s
MATHEMATICS OF COMPUTATION
VOLUME 53, NUMBER 187
JULY 1989, PAGES 411-414
A New Method for Producing Large Carmichael Numbers
By H. Dubner
Subscribe to:
Posts (Atom)