Follow Slashdot blog updates by subscribing to our blog RSS feed

 


Forgot your password?
Close
typodupeerror
×
Mozilla The Internet

Mozilla to Include Crypto 161

Posted by Roblimo from the keeping-secrets-with-a-lizard dept.
Willy Wonka passed us the news that Mozilla's M14 release will include crypotography on the branch. If you'd care to add your eyeballs to the debugging process, please do: Christine Begle posts in the n.p.m.seamonkey newsgroup, "We need help from the Mozilla community to test the crypto-enabled M14 candidate builds. Some tests and test plans will be posted to mozilla.org sometime on Tuesday." That's today, folks.
This discussion has been archived. No new comments can be posted.

Mozilla to Include Crypto More

Mozilla to Include Crypto

Comments Filter:

  • Re:"all of this is built by Netscape" (Score:1)

    by Anonymous Coward
    Sorry, but if I can't see the source myself, it's not going on my computer.

    Yikes! I didn't know the Gnu Public Virus was infecting living organisms now. Or are you just a bot?

  • Does this thing compile on OpenBSD? (Score:1)

    by Anonymous Coward
    Inquiring minds want to know.
  • Right, I'm familar with OpenSSL, and yes it is one possible source for implementations of the underlying crypto algorithms, including RSA. There are others as well. The PSM/NSS source code already released by iPlanet (formerly the Sun-Netscape Alliance) or to be released later already includes code for the SSL protocol itself, it needs the crypto code to go underneath SSL.
  • It would be extremely cool to see some built-in PGP for the email/news client. Or at least hooks to use an external PGP/GPG.

    Based on what people have posted to the netscape.public.mozilla.crypto newsgroup, I would not be surprised to see Mozilla plugins for both commercial PGP (from NAI) and for Gnu Privacy Guard. However it's premature to speculate on exactly when these might be available.

  • ... when will the new export regulations take effect, so you don't have to be blessed by a major corporation to ship?

    You don't need to be a major corporation to export crypto software. Under the new regulations released in January, anyone in the U.S. can export open source crypto software with minimal restrictions (basically a requirement to notify the US government of the URL of your download site).

  • Once the RSA patent expires then other people in the U.S. may write and release code implementing the RSA algorithm without requiring a patent license from RSA. However the code supplied by RSA Security will still be proprietary. What the expiration of the patent will allow is creation of an alternative RSA implementation which is open source and can be freely used with the Mozilla source base.

    Such code already exists in a library called OpenSSL. It also implements TLS with DSA / ElGamal.

  • You are kidding, right? Any way to document that? I'd love to add that to the arsenal of crud against SurfWatch (as, I'm sure, would the guys in Holland...)
    ~luge
  • I think if you search the mozillazine archives, you'll find a suggestion on how to do it. You'll need the newer nightly binaries, though- M13 won't cut it.
    ~luge
  • Well, sure- it has been in 2.2 unstable since times unknown (M6, IIRC.) But I'm pretty sure it wasn't in slink.
    ~luge (proud woody user)
  • Mark,
    This effort is appreciated. I will switch to Mozilla very soon.

  • Does anyone know how to get Mozilla to work with SOCKS? I'm stuck on the internal IBM network and I'd love to use Mozilla. On the bright side, M13 appeared to work very well on all our intranet stuff.
  • "The fact you don't see Linux users for instance starting a write-in campain asking Microsoft to port IE and other Microsoft software to linux like the Amiga and Atari ST users did should tell you something......" No, but you do see Linux users begging Sun to port Java for them. Before Sun released the JDK for Linux, the Linux port was the #1 RFE on the Java developer site. Now, it is the BSD Port. Linux users do ask for things they want from companies instead of doing it themselves (with the exception of Blackdown).
    --Ivan, weenie NT4 user: bite me!
  • No you don't. Most Linux users for the most part could care less about Java. It's one of the big complaints you hear from the Java crowd.

    No, you are incorrect. Take a look at: Java Request For Enhancements [sun.com]. The Java port was *by far* the number one requested enhancement ever. I am not saying there is anything wrong, just don't say Linux users never ask for anything from big companies.


    --Ivan, weenie NT4 user: bite me!

  • Well, IE is not an option on my SGI IRIX box. Actually, Netscape is the only browser I found for IRIX. At least Linux has *some* options: Opera, KBrowser, Mozilla binaries, and others. IRIX is just behind (until SGI switches over to Linux).

    But I my Windows box I use IE. It is worlds better than Netscape.

    Besides, surfing the web got boring. :) I prefer to use my computers for some hacking. (Windows for music, SGI for graphics).

    Cheers!

    --Ivan, weenie NT4 user: bite me!

  • Then why are you having to beg people to do it? Seriously.

    Cheers,
    ZicoKnows@hotmail.com

  • Implementing unfinished standards helps to speed adoption, by getting developers used to using them. Not only does it give them a head start, but it highlights poor specification features and possible improvements, because people are using it in real situations and in decent numbers, letting them see the flaws. Microsoft never disguised the fact that their early implementation might differ from the final standard, and warned developers accordingly.

    Cheers,
    ZicoKnows@hotmail.com

  • <laughs>Well, despite your flaming me, your first paragraph cracked me up.

    And c'mon, you know you'd get bored if there was nothing more to these threads than boosterism mixed in with off-topic trolls. It gets a bit much and I just can't help but post and inject a little reality into the discussions before my eyes completely roll out of their sockets. ;)

    Now, you gonna tell me that Mozilla's FAQ answer wasn't completely weak? It was like, "No we don't support that feature, but don't think about that -- let me distract you with some famous Internet guy lashing out at that evil Microsoft"

    Cheers,
    ZicoKnows@hotmail.com

  • OK, but will it still be a coup if his begging isn't successful? :)

    Actually, an open source browser isn't all that important to me personally, but I do want to see them put out a great browser -- both Mozilla and Internet Explorer will benefit down the line by their competition if Mozilla puts out a good browser.

    I tried out some earlier builds, although now I just try out all the milestones, but the layout glitches or the lack of oodles of extras (or even Java) isn't what keeps me from testing Mozilla more than I do -- it's just that it seems to take so much longer to get things done. I always lose my patience and give up using it after about one night until the next milestone comes out.

    Cheers,
    ZicoKnows@hotmail.com

  • heh.
    The defcon (www.defcon.org) mailing list is having a day where everyone encrypts their mail today. Some of the listmembers are including a perl implementation of RSA and cc:ing to BXA just like you describe.
  • The amount of time it takes to craft a quality product has nothing to do with the model used to craft it. The reason the OSS model tends to produce code with fewer bugs is because more people means more people making sure that the software design's a good one, (in the planning stage) and problems in the finished code get fixed easier and quicker because people have the source.

    That having been said, the total amount of time it takes to create an OSS product is a heckuva lot longer than that it takes to create a closed-source product. Sometimes because messier code is used, often because the developers are able to communicate easier, and definitely because they have more time to work on it.

    This is why projects like Mozilla and the Gnome-related company Miguel started up are so important; they're experiments in how we can get better-quality OSS software developed quicker and better.

    James
  • Yes, I noticed that to! I want it now! want, want, want!

    (impatient :-)

  • yup. gpg would be cool.
    -B
  • Ot most certainly WILL run on 16 MB of RAM. I run it on a P100 with 16 MB RAM _AND_ Windows 98 and it's not the fastest browser but it does run. Hell I run it side by side with Netscape Communicator on this slow system with win98 and it does run. There are many non windows systems that I'm sure would support it even better. I also run it on a P90 with 32 MB RAM and am completely satisfied with its performance. It simply rocks on my PII 350 with 64 MB RAM. Don't count this one out for slower systems just yet.
  • I think you are confusing this with when the patent for the RSA crypto expires...the new export restriction rules are already effective but most companies needs to let their lawyers investigate them first....hence the delay
  • Just wondering, can and will the rest be released when the RSA patent expires?
  • yeh, I saw that...

    But by the time that Mozilla is released, a "standard" for XSL(T) is going to be released, and Mozila is then going to be behind...

    again...

    seriously, I think that someone needs to look at making a hook into Mozilla that parses XML using XSL(T) and all the other happy horseshit that starts with an X (XPath XPoint...)
  • wow... the time between milestones is getting nice and tight... and the daily build releases are quite good, too...

    Has Mozila decided to support XSL(T) yet? Or are they still insisting that CSS is the way to go?

    ANd I wish I could get the damn thign to run on my SuSE box... grrr...
  • FreeBSD, however, isn't a "distribution". It's an Operating System.

    Hmm, how would you define a "distribution" then? Do you count, say, Debian as a "distribution"?
  • Crashes and dies or just locks up on java for me
  • I do use IE under windows for java
    Netscape roaming is the killer feature that makes me keep it around.
    And well IE on linux just isn't there, if it was I'd use it.
    Mozilla stability, not really that bad, at least compared to Netscape 4.7 with java

    I will admit Java in 4.7 is a lot better then the earlier versions, but it is still bad enough for me to run 4 or more instances of it during regular usage
  • Thats all nice and stuff, but I would rather have Java support.
    Java, Javascript and all that stuff is required for some sites.

  • I just want to know when the Moz will be runnable on MacOS

  • Ugh, /. parser killed that message. Sorry.

    Should have said "I just want to know when the Moz will be runnable on MacOS < 8.5."

  • > ANd I wish I could get the damn thign to run on my SuSE box... grrr...

    I was able to convice mozilla to run on Suse 6.3 intel by copying the libjpeg.so from /usr/lib/mozilla/lib/libjpeg.so (from install of mozilla.rpm) to the mozillaNightly directory as filename libnsjpeg.so and libjpeg.so.62.

    However, it [mozilla] doesn't run very well. If I track down a newer copy of this library we are good to go.

    norom
  • tried getting some socks wrapper libs?

    I use dante's socksify libraries/script.
  • Release of complete crypto source for Mozilla based on the PSM/NSS [mozilla.org] software and architecture depends not only on expiration of the RSA patent but also on replacing all the proprietary source code licensed from RSA Security and other third parties. That's the goal, but there's enough integration and other work involved that it's not going to happen overnight. But I do expect to see it happen; exactly how and when it happens remains to be seen.
  • There are browsers that support SSL, but Mozilla is not yet one of them; anything that even smelt of crypto was ripped out of the original Mozilla code due to US export regulations. What's being added to Mozilla are hooks to allow invocation of a component to do SSL; at least one such module (PSM [mozilla.org]) will be made available in binary form and also has had partial source code released for it, with the goal of complete source down the road. People are free to implement other alternative SSL modules for Mozilla as well.

    Mozilla does not yet have support for encrypted email, either S/MIME or PGP-based. I expect both to become available later sometime, but it's too soon to guess at dates.

  • All that would involve is finding a mathematician who can derive an equivalent (but mathematically distinct) fuction to the RSA function within the bounds that are useful to programmers.

    If such a function exists, it would not violate the patent, as the patent (as I understand it) specifically covers the function and not the mapping of input to output.

    However, the chances are that it would take considerably longer to derive such a function than it would be to just ride out the patent. That should not deter Open Source evangelists from trying, though, as a totally unencumbered function would be useful from the perspective of eroding the notion of Intellectual Property.

    (If you could duplicate the O=f(I) mapping for one piece of code, without duplicating any patented algorithm, it would render algorithm-specific patents rather pointless.)

  • f(x)=g(x), IFF you are talking about all inputs.

    I specifically restricted it to the useful range of inputs, at which point the relationship between f(x) and g(x) outside of the range defined is undefined.

    How is this practical? Well, let's define f(x) as being defined over the range of integers, and h(x) as being defined over the range of reals. h(x) is approximately f(x), within 0.5 either side, over the range that x is normally used.

    Then, define g(x) as round(h(x)). g(x) is now equal to f(x), within the normal range of x, but is defined over a completely different function, and would significantly diverge if taken outside of that range.

  • Some trivial examples of what I mean:

    round(x + 0.1 * x) = x, when -4 Let f(x) = x + f(x - 1), where f(0) = 0.
    Let g(x) = round(3.2 * (x - 1)).
    f(x) = g(x), over the interval 2 sin(x) = x, for very small values of x, if appropriately rounded. However, if left as-is, or taken over a larger range of x, then sin(x) != x.

    These are meant to be trivial examples, but they do show how two totally different functions CAN coincide over limited intervals. We don't NEED a clone of the RSA function, over the entire range of integers, as it's only meaningful over the interval of one unit of data, which gives you a very limited range over which the two functions would need to coincide.


  • "Then why are you having to beg people to do it? Seriously.

    "OK, but will it still be a coup if his begging isn't successful? :)"

    From my personal use and what I've heard from others, it is already a very good product and therefor IMVHO it is already a coup. I just want it to be the best product possible and thereby be the biggest coup possible.

    Readers of Slashdot are aware of each and every milestone release and it seems as though it is taking a long time for version 1.0 to arrive, but considering the complexity of the product and the fact that it has been re-written with a new engine in place, I think it is an incredible feat and the Mozilla/Netscape guys should be applauded. They probably feel like the "Rodney Dangerfield" of the software world, getting little or no respect.

    By the way, I don't remember anyone ever stating that the OSS method of software development was the necessarily the fastest . It takes time to craft a quality product. Besides, we don't want Mozilla to be like the bug-laden products of some companies out there...do we? Of course not.

    kuro5hin.org [kuro5hin.org]
  • BigBaldGuy-
    That's great to hear. I knew that part of the problem was proprietary (read: unfreeable) stuff, and I'm sure your intentions are good. My one concern is whether or not I'll be able to use it with nightlies (since I use those and not the M builds.) Any idea if that'll be the case?
    ~luge
  • Any idea what kind of restrictions would be placed on mozilla now that it has crypto? I'd like to see a fortify build for mozilla.. would be nice (can get rid of netscape for banking)

    I'd like a nice replacement mailing tool with gpg support.
    --
  • Hi. Mozilla still barfs after about 5 seconds on my SMP Celeron sysstem (Under Linux, glibc 2.1.13, kernel 2.2.14.) This is supposed to be due to the fact that it's not "thread safe." Anyone know when this will be addressed? Ben

  • PGP (Score:2)

    by Phexro ( 9814 )
    It would be extremely cool to see some built-in PGP for the email/news client. Or at least hooks to use an external PGP/GPG.

    I think that a lot more people would be more interested in defending privacy/crypto rights if it was more visible to the end-user community.

  • First of all, it sounds incredibly catty on Mozilla's part, throwing in a completely irrelevant quote from Tim Bray about Microsoft. Bray was nudging Microsoft to improve other parts of their browser instead of focusing on XSL, not trying to scare people off from trying implementations of XSL. Waiting until standards are completely finished before doing any kind of implementation just slows the whole process down, because people won't realize the cool stuff they're missing. Just because he wants full XML+CSS support first doesn't mean that people are supposed to wait around and do nothing on the XSL front. Mozilla twists his point around and uses it as an excuse for why they can't do both.

    And oh yeah, XSLT, XPATH, XSL are all to the point -- the first two being W3C Recommendations, and the last a Working Draft -- where xml.com (the source quoted by Mozilla) considers them to be standards, making Mozilla's claims even more dubious. Perhaps they need a few more free volunteers to update their FAQ for them?

    Cheers,
    ZicoKnows@hotmail.com

  • So, if they don't have any kind of early support support for the XSLT standard now (available at http://www.w3.org/TR/xslt [w3.org]), then they're already digging another hole for themselves.

    Cheers,
    ZicoKnows@hotmail.com

  • Upon reading the posts on the binary part of the crypto component, I believe (IANAL!!) that Mozilla still does the same thing, send a link to the source to the BXA, and provided that whatever binary they're calling has been approved for export, all is well in the world.

  • copy and paste on *nix under X has always been a bit of a struggle (you might dig around on jwz's site for one of his rants on the matter) --although on win32 and mac I think this should be pretty much there; as for CRYPTO, well, it's coming (clearly); prefs have been updated greatly and window size persistence is fixed now; as for Java issues: ya got me -- I have no idea.

  • Question - if the binary is public domain, wouldn't the source be public domain? And would patent law require them to publish their code?
  • Ahh, the days when a post could be moderated -2. Anyways not to be rude, but it will be opersource eventually, like in september. But there is this little problem of RSA patents that have to be dealt with. And if you want to play in the RSA field you gotta follow their rules. Anyways all of this is built by Netscape and is under inspection by many people who will have access to the source. So please calm down and take your seat in the corner.
  • XSLT support is checked into the mozilla tree, using a 3rd party contributed tool called Transformiiix. The tool is being integrated into the rest of the XML code, but that integration is not yet complete, because there are other things of higher priority they need to work on. You can help by reading the netscape.public.mozilla.layout.xslt newsgroup, and getting involved.

  • Probably because damn near all the secure sites out there talk RSA. They can implement SSL all they like and even include other encryption methods into Mozilla, but without RSA they might as well not bother.

  • At least according to Jan Leger's post on the Seamonkey news group.

  • He said "It's going to be" a coup, by which, I take it, all indications are that the finished product will be good. But this doesn't mean that you shouldn't contribute where you can (if in fact having an open source browser matters to you), because the more people contribute not only coding but bug reports, the better Mozilla will be.

    Admittedly you *will* have to put up with more if you use mozilla as your main browser. As crappy as Netscape on *nix is, it's got more working features than Mozilla -- at the moment.

  • I don't remember anyone ever stating that the OSS method of software development was necessarily the fastest.

    I think open development is *eventually* faster than closed development, because a bunch of hackers will want to make something which is easy to hack. A project controlled by a single company will sooner or later sacrifice future hackability to meet a release date *now*. Notice I say "open development", not just "open source"; if all development is being done by one company then the same commercial pressures apply. But Mozilla *is* largely "open development" in spite of the high proportion of Netscape coders - decisions are taken by non-netscape developers too, so there are voices in there which aren't subject to Netscape's commercial pressures.
  • HOORAY MOZILLA! Just when they've missed another on-the-wire date and you start to lose hope, they pop back up again. You guys are big encouragers, especially by jumping into the forums here and educating us all.

    ---
    In th is usenet article [deja.com], Jim Roskind goes into some of the plans for M14 and beyond. One point he brings up (and this is the where-you-can-help part) is that the main things which prevent a commercial-branded alpha/beta are the "beta-stopper" bugs; bugs which are first marked beta1 on submission, then reviewed and marked by authorization as PDT. These beta-stoppers, by virtue of their priority, draw human resources from across Netscape as well as just the seamonkey group.

    So if you can, test the program. If you find a beta-stopper - some real bug like a crash or a performance problem - report it and mark it beta1. These draw special attention from the mozilla people, and if promoted to PDT status, will attract extra developers from Netscape.

    ---
    Someone else at MozillaZine had some insights [mozillazine.org] about a (possibly semi-official) name for the full completed package: Netscape 2001 or some such. Yes it is the year thing, but as Henrik points out, it could be succesfully tied into the air of cooless surrounding 2001, A Space Odyssey. Maybe they'd even give it a classical soundtrack :-)

    -- If you lived here, you'd be home by now.
  • There is a library - RSAREF - written by RSA implementing the RSA algorithm. It's license permits non-commercial use, but forbids any modifications whatsoever to it's code, which is structured in a way that doesn't expose APIs needed for https. As I understand it, for SSL, the commercial library from RSA, BSAFE, is needed, as well as some further modifications. BSAFE allows modifications, but forbids the distribution of modified source (or even source at all). So closed-source it is, until the patent expires. Even then, it will be necessary to re-write the code to use something else, as RSA's copyright on their library will still be valid. It will just be legal to use something else.

    can you trick the library into becoming an api using #define?

    --

  • <whine>According to the milestone page [mozilla.org], M14 was supposed to come out on 2/18. The beta beancounter [mozilla.org], which is linked to from the milestone page says it's supposed, currently says it was to come out this morning.</whine>

    Anyway, from recent binaries, mozilla looks like it's coming along pretty well. Some of the High-vote bugs [mozilla.org] (not including mine [mozilla.org]) have been sitting on the table [mozilla.org] for a while, but a lot of smaller issues have been corrected since M13.

    --

  • I'd like to appeal to everyone. If you like Linux and especially Open Source Software, please download this release of Mozilla (and future releases as well) and use it, abuse it, and break it. Then, report those bugs! This is going to be one of the biggest coups for Open Source Software and show a lot of detractors that OSS is a viable method for developing quality software. It will also blow away a lot of FUD concerning security issues, etc. of OSS (because it's open.) Thanks.

    I'm just worried that mozilla will be so large that there won't be ten hackers who understand any given line of the source code. Has this ever been a problem with other open source projects?

    --

  • Turns out you set a ld_preload when you run the mozilla running scripts. It also turns out that runsocks ALSO uses a ld_preload. You can merge the two ld_preload commands and that actually works pretty well (Or has when I tried it, YMMV.)
  • It could just negotiate with my web server, exchange a non-patent encumbered GPG key, and use that for the session?

    Lets see if the Mozilla Team and the Apache team manage to hack that in to their software before I beat them to it...

  • Just to clarify, there most certainly WILL be XSLT support in Mozilla. Everyone agrees on this. It's just too late at this point to add it in to the initial Mozilla release. I am dying for it too, but if it will set back an initial Mozilla release by another 2-3 months (which it will) then I'll pass for now. If it's not being worked on by the first point release, there are plenty of us who will go write it ourselves. It's Open Source, it will get there, it's just that debugging the already built functionality has to take precedence at this point so the first release can get out the door cleanly.
  • - I can copy/paste in and out of the program
    - save preferences easier (i think this has been fixed but i don't do CVS)
    - use CRYPTO!
    - Have it save the size of my window (fixed too?)
    - pages like www.cleveland.com [cleveland.com] will load (java shit)

    how's the outlook for m14? Think i'll be able to trash netscape finally?

    - Mike Roberto
    -- roberto@apk.net
    --- AOL IM: MicroBerto
  • > Do any distributions ship with Mozilla?

    Yes. Suse 6.3 includes Milestone 12. I believe 6.2 had a milestone as well.

    norom
  • >I can download the binary and use RSA FOC.

    yes.

    >I can go to the ibm hosted patent site and >download the RSA patent.

    yes.

    > I am not legally allowed to implement the patent, although I can
    > legally download source that implements the patent in other
    > countries.

    But you can't have that source in the U.S. So you can only download it from other countries to other countries. In the U.S. it's RSA's way or no way.

    > I just don't see that not allowing the source to be open is such
    > a big deal. I mean, the cat is out of the bag. I cannot legally
    > distribute software using RSA until September, but I can
    > possess source code that would implement it if compiled, and

    No you can't, I don't think.

    > I can FREELY possess binaries that implement it (such as
    > netscape, IE, ssh - for non-commercial use...)

    There is a library - RSAREF - written by RSA implementing the RSA algorithm. It's license permits non-commercial use, but forbids any modifications whatsoever to it's code, which is structured in a way that doesn't expose APIs needed for https. As I understand it, for SSL, the commercial library from RSA, BSAFE, is needed, as well as some further modifications. BSAFE allows modifications, but forbids the distribution of modified source (or even source at all). So closed-source it is, until the patent expires. Even then, it will be necessary to re-write the code to use something else, as RSA's copyright on their library will still be valid. It will just be legal to use something else.

    > Exactly how much of a head start is it going to be for mozilla
    > to distribute the source ?

    huh? the source can't be distributed, becasuse that would violate it's licensing terms.

    > I also realize the REAL issue is that mozilla NEEDS permission to
    > distribute the source, and that is the real hangup. It all seems
    > so silly.

    mozilla can't violate the terms of Netscape's RSA license, because that would void Netscape's license to have RSA code. So it's never going to open in its current form, but I would expect to see an OpenSSL-based replacement for the plugin sometime soon, probably distributed only to non-US users at first and replacing the RSA-licensed one after the patent expires.
  • This isn't done because there isn't any good way to grab those events for links. Some changes to the event model are pending (for other features as well), but this is stuck waiting on them. Go vote for bug #6085, that (believe it or not) actually does influence a bug's priority... there's a hackish patch that implements this attached to the bug, but nobody wants to merge it because it's pretty ugly (or so I'm told)
  • Yeah, a bunch of people have been working on optimizing the repaints and, on UN*X platforms, X11 protocol usage.
  • It's held up because they decided the crypto *could* make it and now they're waiting for the crypto people.
  • Umm.. how about implementing other encryption algorithms. Perhaps of non-US origin? Try GOST from Russia for example.

    Here [mach5.com] are links to GOST and others.

    --
  • unless i've forgotten more of my math than i think i did, this is impossible. there is no way to find an "equivalent (but mathematically distinct)" function to the RSA function. this is because if you have two functions f and g such that f(x)=g(x) for all x (as would be required) then f=g. Of course, they may be written differently (i.e. a trivial case of functions written differently would be f=tan(x), g=sin(x)/cos(x)). However, this does not mean that these are not the same exact function.
  • Browsers support SSL now, and that includes encryption. What's being added? Encrypted E-mail support?
  • RSA is not something like a sorting algorithm or a FFT; the Perl slogan There's More Than One Way to Do It is not applicable here. If we model the core RSA function m=c^e mod n as an bijective function f() from Z/Z_n -> Z/Z_n (the field defined by the integers modulo), simple uniqueness considerations on the operators over the field dictate that there is no other function g() that maps the same bijection between Z/Z_n -> Z/Z_n that is distinct from f(). Neccesarily, if f(x)=g(x) for all inputs {x|x E Z/Z_n}, the function f()==g() for a sufficiently broad generalization of the underlying field (irrespective of the specific structure of the field). Essentially, any shortcut that allows the computation of the RSA function without carrying out the same operation means that the RSA function has an some extremely unexpected properties. RSA is probably broken if it ever gets to that point.
  • Your statement is not strictly true. In order to define equality of two functions, we must establish the mathematical space under which the functional operations are carried out. In the case of the reals, the space has enough underlying structure (ie. Taylor series, Cauchy-Dedekind representations) that we can prove equality for a certain small minority of functions defined over the reals. This is not as trivial as it seems; a theorem by Richardson states that [handwaving here; read the proof for the details] even for a surprisingly simple class of expressions over R (the rational numbers), the predicative identity E=0, where E is a any finite, recursively definable expression under the certain strict constraints, is not decidable. Your posting is not generally correct, but nonetheless applicable for the question of the RSA function, unless there is something very surprising that we have yet to discover about it.
  • Ouch, that's embarassing. My thesis advisor would probably have had me drawn and quartered for that. I misstated Richardson's theorem: R is the class of expressions formed by: 1) The rationals, PI, and ln(2) 2)A single dependent variable x 3) The operations of addition and multiplication, and 4) The sine, cosine, exponential, and absolute value functions. Composition is allowed, of course. The predicate E=0 cannot be decided for arbitrary E in R.

    I think the above paragraph is right, but I'm not sure I got all the details right and those little proof demons always lurk in the details...
  • I'm using a binary of Mozilla to write this, on Win32. If you take a look at the Mozilla binary releases I'm sure you'll find it's far away from Linux-x86 only.

    I understand what you mean, I've seen bunches of these "binary=linux-x86" only programs... but I don't think it'll apply in this case.

  • Re:Thats nice, but where is Java? (Score:3)

    by Matts ( 1628 ) on Wednesday March 01, 2000 @02:36AM (#1236977) Homepage
    Dude, it's in there.

    You just need to complain to Sun to get a Java 1.3 implementation out of the door so that you can use JNI (or whatever the appropriate acronym is) to plug it into Mozilla.

  • Re:How about other algorithms? (Score:3)

    by stripes ( 3681 ) on Wednesday March 01, 2000 @04:11AM (#1236978) Homepage Journal
    Umm.. how about implementing other encryption algorithms. Perhaps of non-US origin? Try GOST from Russia for example.

    RSA is a public key algo, one key to encrypt, a diffrent key to decrypt. GOST is a private key algo, on key that can either encrypt or decrypt. If you have a public key algo you can publish your encryption key in a "well known place", and anyone can use it to send messages only you can decrypt (read). With a private key cryptosystem you can not publish the key, anyone that had it could not only send messages, but read them.

    To replace RSA in a functional sense you need another public key algo. The only one I know of is a circular arc or some similar thing, "only" discovered within the last decade (five years I think), and not understood by cryptographers well enough to trust all that much. I think GPG can/does use it.

    The other problem is that would only be a functional replacment, it won't interoperate with SSL implmentations using RSA. For that only RSA will do. Which can be used outside the USA patent free. In the USA we have to wait until later this year (Septemberish).


    P.S. the reason PGP/GPG/SSL uses a public key system plus a private key system is that public key systems are slow and bulky. They greatly expand the size of the data you encrypt with them (like sending a 8-bit value with a 1024bit RSA key gives a 1024bit ciphertext). So they make a random sesison key encrypt it with the public key system, sent it, and send the rest of the message encrypted in the session key using the private key cryptosystem. This give three points of attack, the public key system, the private key system, and the random number gennerator used to make the session keys, so obviously this would be avoided if it could!

  • Whenever Debian freezes it will ship with Mozilla (not sure which build, though.) Advancement of Mozilla is pretty crucial for Debian, since (unlike other distributions that would ship Mozilla as a supplement to Netscape) Debian doesn't distribute Netscape with the core of the distro. Until there is a usable Mozilla, Debian will continue to ship without a "serious" browser.
    Grain of salt: I'm posting this from yesterday's build, so I (personally) consider Mozilla pretty damn fine stuff. But it's just not quite ready for mainstream acceptance (which is my Debian isn't in great shape, web-wise.)
    ~luge

  • I would prefer to see stabilty (Score:3)

    by NYC ( 10100 ) on Tuesday February 29, 2000 @11:47AM (#1236980)
    Personally, I would like to see a nice, quick, and STABLE browser. Who needs Java to surf the web? If you want Java, just use Netscape.

    The latest Mozilla release does not even compile sucessfully on my IRIX box, let alone run correctly.


    --Ivan, weenie NT4 user: bite me!

  • RSA algorithm is what will become public domain. (Score:3)

    by cpeterso ( 19082 ) on Tuesday February 29, 2000 @11:59AM (#1236981) Homepage
    if the binary is public domain, wouldn't the source be public domain? And would patent law require them to publish their code?

    The RSA binaries won't be public domain. I believe the patent on the RSA algorithm expires this autumn. With the algorithm in the public domain, anyone can legally write their own RSA code. BTW, how long do patents last? I think it's 17 years.


  • fortify.net ; www.openssl.org (Score:3)

    by billstewart ( 78916 ) on Tuesday February 29, 2000 @12:26PM (#1236982) Journal
    Fortify.net is a UK site with software that fixes Netscape 40-bit browsers so they'll do 128-bit. One useful feature the web page has is an SSL checker
    https://www.fortify.net/sslcheck.html [fortify.net]
    which tells you what level of encryption you're running.

    www.openssl.org [openssl.org] has an Open Source implementation of SSL. I think their latest version is 0.95.

  • Re:SOCKS support (Score:3)

    by adric ( 91323 ) on Tuesday February 29, 2000 @11:52AM (#1236983)
    I believe that M15 is (currently) the target milestone for adding SOCKS support. See bug 16103 [mozilla.org] for more info.
    ---

  • Re:I might add (Score:3)

    by blakestah ( 91866 ) <blakestah@gmail.com> on Tuesday February 29, 2000 @03:01PM (#1236984) Homepage
    I don't get this.

    I can download the binary and use RSA FOC.

    I can go to the ibm hosted patent site and download the RSA patent.

    I am not legally allowed to implement the patent, although I can
    legally download source that implements the patent in other
    countries.

    I just don't see that not allowing the source to be open is such
    a big deal. I mean, the cat is out of the bag. I cannot legally
    distribute software using RSA until September, but I can
    possess source code that would implement it if compiled, and
    I can FREELY possess binaries that implement it (such as
    netscape, IE, ssh - for non-commercial use...)

    Exactly how much of a head start is it going to be for mozilla
    to distribute the source ?

    I also realize the REAL issue is that mozilla NEEDS permission to
    distribute the source, and that is the real hangup. It all seems
    so silly.

  • Re:wont run with 16 megabytes of ram (Score:3)

    by puetzk ( 98046 ) on Tuesday February 29, 2000 @01:34PM (#1236985) Homepage
    No, mozilla won't run in 16 Mb of RAM. If that's all you have I suggest you use browsers from when computers had 16 Mb of RAM.

    simplebrowser (./run-mozilla.sh ./simplebrowser) might, though it's more of a debug tool at this point. It's mozilla's layout engine sans chrome. I'm not sure, though, that the milestone tarballs include it and/or all it's pieces.

    Otherwise, you may find w3m more your style. It's a textg-mode browser but with support for mouse (xterm or gpm), tables, frames, etc.
  • The RSA binaries won't be public domain.

    To clarify this a little more: the security library for Netscape Communicator (which will also be in the iPlanet PSM binaries that will work with Mozilla) incorporates proprietary code from RSA Security, and some of that code implements the RSA public key algorithm, on which RSA Security has a patent in the U.S.

    Once the RSA patent expires then other people in the U.S. may write and release code implementing the RSA algorithm without requiring a patent license from RSA. However the code supplied by RSA Security will still be proprietary. What the expiration of the patent will allow is creation of an alternative RSA implementation which is open source and can be freely used with the Mozilla source base.

    I believe the patent on the RSA algorithm expires this autumn.

    September 20, 2000 (which actually is in the summer, but just barely). And yes, patents normally are for 17 years.

  • What will it have? Find the answers. (Score:4)

    by jelwell ( 2152 ) on Tuesday February 29, 2000 @11:45AM (#1236987)
    I'm seeing a lot of posts that ask about this or that. Try downloading Mozilla. Mozilla currently supports Javascript up to 1.5 and CSS 1 & 2. Download the build - give it a shot.

    The SSL code will be included in the tip - not the mozilla tree. This means - no one will see the code that is owned by RSA. So using cvs on the tree wont get you all the crypto code - it will probably download at least one small binary file that includes the patented RSA code. Which later this year will fall into public domain.

    Don't forget to help out on the Mozilla project - Mozilla runs great on Mac, Linux, Win32 and all sorts of variant UNIX operating systems as well as OS's I've never even heard of.
    Joseph Elwell.

  • I'd like to appeal to everyone... (Score:4)

    by moonboy ( 2512 ) on Tuesday February 29, 2000 @12:20PM (#1236988)
    I'd like to appeal to everyone. If you like Linux and especially Open Source Software, please download this release of Mozilla (and future releases as well) and use it, abuse it, and break it. Then, report those bugs! This is going to be one of the biggest coups for Open Source Software and show a lot of detractors that OSS is a viable method for developing quality software. It will also blow away a lot of FUD concerning security issues, etc. of OSS (because it's open.) Thanks.

    kuro5hin.org [kuro5hin.org]

  • I might add (Score:4)

    by luge ( 4808 ) <<gro.yugeit> <ta> <todhsals>> on Tuesday February 29, 2000 @11:44AM (#1236989) Homepage
    One important note: the crypto in M14 will not be Open Source. Rather, M14 will incorporate hooks which will be usable with a binary-only crypto module from iPlanet (the offspring of the Netscape-Mozilla alliance.) For more on the situation, read this mozillazine post. [mozillazine.org]

  • Re:If it's not Open Source, it's crap! (Score:4)

    by Mike Shaver ( 7985 ) on Tuesday February 29, 2000 @11:59AM (#1236990) Homepage
    When you're done banding together to implement RSA without violating their patents, please drop us a line. (Have fun storming the castle!)

  • Re:PGP...vote for it then. (Score:4)

    by VValdo ( 10446 ) on Tuesday February 29, 2000 @01:59PM (#1236991)
    Join bugzilla.

    it's bug #22687 [mozilla.org]

    Vote early (and as the old joke goes, vote often)

    W
    -------------------

  • Re:If it's such a coup... (Score:4)

    by Zico ( 14255 ) on Tuesday February 29, 2000 @03:16PM (#1236992)

    Besides, we don't want Mozilla to be like the bug-laden products of some companies out there...do we?

    Don't pick on RedHat like that -- they're still Open Source and could use our support now that their stock's been tanking.

    Cheers,
    ZicoKnows@hotmail.com

  • Well, that's not strictly true. No export to the T-7 (the 7 state supportors of terrorism; Iran, Iraq, etc.), and the code has to be fwd'd to BXA:

    (B) For post-export reports and certification letters, you may submit them electronically to crypt@bxa.doc.gov (suggested file formats include spreadsheets, tabular text or structured text), or to the Department of Commerce, Bureau of Export Administration, Office of Strategic Trade and Foreign Policy Controls, 14th Street and Pennsylvania Avenue, N.W., Room 2705, Washington, DC 20230, Attn: Encryption Reports. A copy must also be mailed to Attn: ENC Encryption Request Coordinator, 9800 Savage Road, Suite 6131, Ft. Meade, MD 20755-6000.

    http://www.bxa.doc.gov/Encryption/qanda.htm


    http://www.bxa.doc.gov/Encryption/licchart.htm
    Product
    Previous Licensing Mechanism
    Update99 Licensing Mechanism
    Technical Review
    Reporting

    Source Code (publicly available, unrestricted)
    IL/ELA
    TSU
    No3,4
    No

    Source Code (publicly available with restrictions)
    IL/ELA
    ENC
    No3,4
    Yes

    Notes:
    3. No review of foreign products(s)
    4. BXA Notification at time of export is required

  • Do any distributions ship with Mozilla? (Score:4)

    by dsplat ( 73054 ) on Tuesday February 29, 2000 @11:50AM (#1236994)
    Once this is stable, it could be the answer to secure open source e-commerce. Apache [apache.org] on the server and Mozilla [mozilla.org] on the client. Both open for peer review, which is the only thing in crypto that gives much assurance of security. To quote the Crypto-Gram Newsletter, September 15, 1999 [counterpane.com]:

    As a cryptography and computer security expert, I have never understood the current fuss about the open source software movement. In the cryptography world, we consider open source necessary for good security; we have for decades. Public security is always more secure than proprietary security. It's true for cryptographic algorithms, security protocols, and security source code. For us, open source isn't just a business model; it's smart engineering practice.

  • Re:Mozilla... reaching critical mass? (Score:4)

    by lostboy ( 79669 ) on Tuesday February 29, 2000 @11:57AM (#1236995)
    From the ngLayout FAQ [mozilla.org]:

    For XML formatting, why is Gecko supporting CSS rather than XSL in the first release?

    Simple: CSS1 is a finished, fully adopted, and mature two-year-old standard; XSL isn't done yet. As Tim Bray, the coeditor of the XML standard, has written:

    "Microsoft's XSL efforts are very impressive, but (readers will pardon us being something of a broken record on this subject) XSL is in the future. We are convinced that from the point of view of the largest number of users, the most important things that Microsoft could do in IE 5 would be:
    1.Ensure interoperability of XML and stylesheets with other browsers, and
    2.Build in conformance to existing, stable, well-understood standards such as CSS 1.0.

    Innovation, of course, is fine and necessary, and we salute Microsoft's leadership in this area. But innovation needs to be built on a foundation of interoperability and playing by existing well-understood rules." He further adds that "It seems obvious to me that for anyone who wants to deploy XML in production mode right now, XML + CSS is the way to go ..." ("Microsoft Outlines XML Support in IE5 Beta 2" at http://www.xml.com/xml/pub/98/10/ie5-2.html)

    -=snip=-

    I understand their reasoning, but damnit, I want my XSL! It's very weird giving XML demos in IE.

  • Re:Crypto .. exportability (Score:4)

    by evil_one ( 142582 ) on Tuesday February 29, 2000 @12:00PM (#1236996) Homepage
    Since the U.S. govt slackened off some of the export regulations, the crypto can be available as long as it is not knowingly exported to a restricted country. Also, since mozilla is using hooks to a binary - the same way the shockwave flash plugin works - one can develop one's own crypto modules if so desired.

  • Re:I might add (Score:5)

    by BigBaldGuy ( 71082 ) on Tuesday February 29, 2000 @11:53AM (#1236997) Homepage
    Hi. I'm one of the developers who is working on getting the crypto stuff out of our internal tree and into the M14 branch.

    It is true that for the moment, this branch will only be useful with a binary-only module that we are cranking out for both 4.x and Netscape 6 browsers.

    However, as you will see here [mozilla.org], we are in the process of getting all the source code that we legally can out there. We made tarballs [mozilla.org] available a few weeks ago, and though that code doesn't build, at least you can get an idea of how the binary piece works.

    We're still working on patent issues, as you might guess, along with a number of other things, before we can have a fully working build in the mozilla tree. But we're getting there.

    Mark Welch [mailto] -- Crypto/PKI developer -- Sun|Netscape Alliance

  • Re:I might add (Score:5)

    by puetzk ( 98046 ) on Tuesday February 29, 2000 @01:22PM (#1236998) Homepage
    I (the person who built the M13 binaries for Linux/PowerPC) am working on this. While I can't have the source either, I think I have a netscape employee who is going too be helping on PowerPC at least. Other people on other platforms, go to irc.mozilla.org #mozcrypto and I expect you will find helpful people who want this to work just as much as you do.

    Chant with me... September 30th... (RSA's patent will expire and SSL won't be such a legal PITA). Right now it has to be binary-only or not at all, due to legal restrictions.

  • Re:I might add (Score:5)

    by john_boy ( 110600 ) on Tuesday February 29, 2000 @12:00PM (#1236999)
    Ugh. This isn't a flame; unlike some others, I'm not going to go ape just because I can't get the source to a couple of the components of one of the apps I run.

    But whenever I hear 'binary-only,' it turns out to mean Linux-x86 only. As someone who runs Linux (yes, real Linux, new kernels and all) on a PowerPC [linuxppc.org], this won't be the first almost-must-have goodie denied to me -- and I'm sure folks who run on other open source OSes, even on the x86, can relate.

    John

  • www.mozillazine.org vs. Censorware (Score:5)

    by John Hurliman ( 152784 ) on Tuesday February 29, 2000 @12:22PM (#1237000) Homepage
    Curses! http://www.mozillazine.org is blocked by SurfWatch! Just when I was about to get a stable browser that works, the filtering companies decide open source software is against their morals :-(

Slashdot Top Deals

Ya'll hear about the geometer who went to the beach to catch some rays and became a tangent ?

Close