- security-devroom - lists.fosdem.org

[Security-devroom] pgp key signing reminder
by Nikos Mavrogiannopoulos 12 Jan '11

12 Jan '11

A reminder for the interested to participate on the key signing. http://www.fosdem.org/2011/keysigning

1 0

[Security-devroom] Re: talk scheduled twice: BOFH meets SystemTap
by Adrien Kunysz 06 Jan '11

06 Jan '11

On Thu, Jan 06, 2011 at 01:39:33AM +0100, Mattias 'Tias' Guns wrote: > We are very happy to announce that your lightning talk proposal has been > accepted! (see full list below) > [...] > In case you are no longer able to give your talk, or in case it was also > submitted and accepted at a devroom, please notify us asap. > [...] > BOFH meets SystemTap: rootkits made trivial (Adrien Kunysz) Thank you. I also submitted this talk to the security devroom although it is unclear to me whether it has been definitely accepted there at this point: https://www.opensc-project.org/opensc/wiki/FOSDEM2011 http://lists.fosdem.org/pipermail/security-devroom/2010-December/000011.html I am happy to drop one of the two talks as to free up a slot for someone else (although I would also appreciate if my talk was still mentionned in the schedule of both rooms, with redirection as appropriate). Which of the security devroom or the lightning talks room needs a slot back? :)

1 0

[Security-devroom] Introduction talk and training
by Jean-Michel Pouré - GOOZE 05 Jan '11

05 Jan '11

Hello, Could we discuss the introduction talk at FOSDEM. These last two months, I did two presentations at Debian day and JM2L. Based on these presentations, it seems that we could: * Start with a 15 minutes slides presenting the various crypto frameworks at OS level + application level. The last topic on CSP rang the bell to me and this is really hell of a jungle. This presentation could be called 'Hell of a jungle' and be funny. Martin, maybe you could do it or I can take care of it. * Make a 45 minutes training, showing and distributing some hardware. People need to touch and manipulate the hardware and see it with their own eyes. I propose to make that tutorial. I can bring more than 50 readers and smartcards, OTPs and make a detailed training. So to make it clear, my proposal would be to start with 15 minutes of 'Hell of a Jungle' and 45 minutes of training/hardware demo. I am aware that FOSDEM is a developer show, but even developers would probably like to see the hardware. People need to know what kind of readers are available (internal, external, etc ...) and understand how to insert cards, click on buttons. This needs to be simple. Kind regards, Jean-Michel POURE -- Jean-Michel Pouré - Gooze - http://www.gooze.eu

1 0

[Security-devroom] talk proposal: BOFH meets SystemTap: rootkits made trivial
by Adrien Kunysz 21 Dec '10

21 Dec '10

I submitted this as a lightning talk before realising the security devroom might be more appropriate. The Bastard Operator From Hell enjoys abusing his users. SystemTap allows for very easy dynamic code injection system-wide (kernel, libraries, applications). This talk gives a brief overview of what is SystemTap and its capabilities. We then demonstrate how it can be used to dynamically insert questionable code at any level to spy on users and modify behaviours of applications and system components very easily. This is not about novel techniques or breaking trust boundaries (we assume you are root already). This is only about making things easier for both the good and the bad guys. This is a 20 minutes talk (say 30 minutes with pleny of time for questions). About me: I enjoy playing with Unix systems, breaking things, fixing things, reading code and tinkering with low level components and tools (kernel, libc, debuggers,...). I have been using SystemTap a lot in the last few years and started to see it as the ultimate hammer. If you measure Open Source activity by amount of code written, I haven't contributed in any significant way to any project. I wrote small patches to fix or improve tools I use like arping, strace or SystemTap. I co-founded the Free Software Users Group Arlon (Belgium) where technical talks and social meetings are organised frequently. I am currently unemployed and using my free time to toy with ideas like the one described in this talk.

1 0

[Security-devroom] Talk: "Supporting seven SSL libraries and one SSH library"
by Daniel Stenberg 18 Dec '10

18 Dec '10

Hi friends, My suggested talk for the opensc room at FOSDEM is as given in the subject: "Supporting seven SSL libraries and one SSH library" - how libcurl does to support them all and something about their differences. We've supported SSL-based libraries for way over a decade now and to be able to support a wide range of different libs we've managed to come up with a way to make it work. Why so many SSL libs? They're all a little different and I'll provide an outsider's view of how they stack against each other. The SSH situation is different and I'll touch that as well. 30 minutes should be fine for this. I've already added it to the wiki Bio: I'm an open source contributor since over 15 years. I lead and maintain several open source projects (curl, libssh2, c-ares, etc) and I'm a co-founder and contributor to many others (Rockbox for example). See ya all at FOSDEM! -- / daniel.haxx.se

1 0

[Security-devroom] Talk submission : SSH Libraries
by Aris Adamantiadis 17 Dec '10

17 Dec '10

Hello, I'm sorry I did not follow the procedure for the submission of talks. I already put a brief description of the talk on the wiki [1] but give the official submission now. Affiliation: libssh project, BELNET Bio: I'm lead of the libssh project [2], started in 2003. I work at BELNET (Belgian Research and Education Network) as technical advisor. Talk duration: 30 minutes (20 + 5 + 5). Can do less if that's absolutely needed. Talk: SSH libraries - what they can do for you. Since 2003, a few libraries that implement the SSH protocol are around. However, SSL and TLS are very popular protocols. Why would one use SSH for secure connection ? We will present the differences between SSH and TLS, as well as an overview of the different SSH libraries. We will then focus on libssh and give the status of the project, the achievements, and its future. [1] http://www.opensc-project.org/opensc/wiki/FOSDEM2011 [2] http://www.libssh.org -- Aris Adamantiadis

3 3

[Security-devroom] Talk submission: unifying access to PKCS #11 tokens
by Nikos Mavrogiannopoulos 17 Dec '10

17 Dec '10

Affiliation: GnuTLS, Katholieke Universiteit Leuven & IBBT Bio: Original author of the GnuTLS cryptographic library. Has worked on several security related projects and products. Currently works as a researcher in K.U.Leuven. Talk Duration: 30 minutes Cryptographic services in modern operating systems today are being accessed by applications by using libraries, either high level ones that hide all details, or low level ones that force the user to deal with an amount of (un)interesting details of each cryptographic algorithm. Applications in the GNU/Linux and *BSD operating systems usually share the same libraries for cryptographic operations and protocols. Those can be one of Botan, OpenSSL, NSS, GnuTLS and maybe some more. This is quite a variety of choices which we believe is because of the different programming style that each library enforces, the different algorithms it provides and the ease of usage, which are subjective issues that depend on the eye of the beholder. However this diversity of cryptographic libraries has some disadvantages. For operations such as signing/encryption involving PKCS #11 hardware tokens, or software modules, objects need to be referenced. Currently there is no uniform way of referencing those objects and each of the libraries has its own conventions or delegate the burden of referencing objects to the application. This in effect makes sharing of those object references between different applications impossible and users are required to learn each application's unique interface. Moreover the fact that usually there are more than one PKCS #11 providers in a system, but no way to globally enable them for all cryptographic applications, leaves the burden of setup to users. We will discuss the challenges posed and and propose a solution.

2 1

[Security-devroom] How to Store Trust: Assertions
by Stef Walter 09 Dec '10

09 Dec '10

Stef Walter -- stefw(a)collabora.co.uk Affiliation: Collabora Ltd, GNOME Maintainer of GNOME Keyring, and has been involved in a large number of security projects both in the open source community and otherwise. Demystifying crypto and security for users and allowing simple but powerful uses of security technologies is of special interest. Talk Duration: 30 minutes Talk: How to Store Trust: Assertions In order to provide a usable foundation for crypto on the desktop, the various crypto libraries need a way of accessing common information about the user's preferences with regard to certificates and 'trust'. "Trust Assertions" provide a way to represent certificate authority anchors, 'pinned' certificate exceptions, revocation lists, and other bits of trust information. A common method of accessing this information is missing from the open source desktop. We will show how we can make this information available through PKCS#11, so the user's applications (regardless of crypto library) can act consistently when making trust decisions. We'll present one solution, but more importantly: kick start progress in this area and discuss how we can move forward together.

1 0

[Security-devroom] Talk submission, EJBCA and OpenSC
by Tomas Gustavsson 09 Dec '10

09 Dec '10

Hi, Here is my submission for a talk at the security devroom at Fosdem. I can probably jam my session into a 30 minute slot. Who am I? Contact: Tomas Gustavsson Tel: 046-707421096 Email: see from field Affiliation: PrimeKey Solutions AB / EJBCA Bio: Project founder/manager of the EJBCA PKI project (http://ejbca.org/) and CTO at PrimeKey (http://primekey.se) Long time developer and consultant with PKI/security solutions (nowadays exclusively for EJBCA and SignServer). Contributor to projects such as BouncyCastle (http://bouncycastle.org/) Have also sent minor patches to other projects such as pcsclite and openscep. Talk duration: I can probably cram my session into a 30 minute slot. Talk description: "PKI smart cards in practice; usage lifecycle" The whole chain needed in order to use smart cards are quite complex. PKI, middle-ware and cards are needed and must all work together in order to make a succesful deployment in larger scale. This talk will demonstrate how opensc can be used together with EJBCA PKI, using smart cards as an HSM for the certificate authority, issuing certificates to user smart cards to be used for client authentication. We will show where the tricky integration points are and talk about what we can do about it together.

1 0

[Security-devroom] talk proposal: dynalogin two-factor authentication
by Daniel Pocock 08 Dec '10

08 Dec '10

Hi, I've recently released some code that I wrote a while ago for two-factor (particularly HOTP) authentication. http://www.dynalogin.org If you feel this is of interest, I would be happy to participate in or lead a session about this at the dev room. I understand that some of the other dev room participants have already contributed to this project indirectly through the HOTP toolkit and in other ways. My vision for dynalogin is a solution that can be deployed as a package on Linux distributions and be instantly up and running, enabling almost plug-and-play two-factor authentication for UNIX, RADIUS, OpenID and other technologies. Session duration: flexible, up to a full 1 hour slot is fine Open source background: long time user of Debian. Release of open source (but sadly not open patent) G.729 module for Asterisk. Contributed a B2BUA to the reSIProcate SIP stack project. Developer/release manager on Ganglia project, and possibly one of the largest commercial deployments of Ganglia/rrdtool. Professional: secure connectivity and messaging solution developer, investment banking Also of interest: B. CompSci received at Melbourne Uni (co-incidentally, the school where Wikileaks founder Julian Assange studied) Also, there is an error on your original message, linked to from the FOSDEM main page ( http://lists.fosdem.org/pipermail/fosdem/2010-December/001083.html ), you have (twice) a link to http://lists.fosdem.org/mailman/listinfo/fosdem and I think you mean to link to: http://lists.fosdem.org/mailman/listinfo/security-devroom Regards, Daniel

1 0