Category Archives: security

EnigForm – HTML/HTTP forms with OpenPGP

Posted on by

Talking to Buanzo, I have been testing the EnigForm plugin for Mozilla. Briefly, EnigForm gives you OpenPGP signing of HTML forms, based on GnuPG, by setting some HTTP headers with the OpenPGP data. This is quite cool, I imagine two use-cases:

  • PGP-based web-authentication. Type your username, have a hidden form field with a nonce, and have EnigForm sign the data. The server verifies the signature, and you have been logged on.
  • PGP-protected web-based forums, bug-tracking systems, polls, etc. What you write in a HTML form is signed by EnigForm, and the server knows who wrote it, and there is persistent evidence of it. Imagine Debian votes through the web instead of via e-mail!

I think this should be documented and forwarded to the IETF for standardization. It is a good example of a simple invention that uses two existing techniques in a new way.

Password-based Authentication Protocol

Posted on by

There was a large increase in activity on password-based SASL authentication mechanism in the Prague IETF, with three new proposals. Unfortunately, I was travelling over the I-D cutoff, so my document didn’t make it. However, I’ve now finished a -00 document for it. The goal was initially to just specify a GSS-API mechanism, but it seemed easier to specify a framework-agnostic protocol (with some influences from GSS-API and SASL) and then specify the mapping to GSS-API and SASL.

http://josefsson.org/password-auth/

Libntlm 0.3.13

Posted on by

I made a new release of libntlm today. There are no feature changes, just an update of gnulib files which offers better portability (hopefully including Mac OS X now).

I also noticed that I was not subscribed to the libntlm mailing list. Bad maintainer. 🙂

Announcing krb5dissect

Posted on by

Building on my earlier efforts to document the ccache format, I’ve now created the krb5dissect tool. It will parse your Kerberos ccache file (typically /tmp/krb5cc_$UID) and prints it in a human readable format.

This tool was written in about 1 hour, given the amazing amount of nice modules available from gnulib, and helpful tools such as gengetopt and help2man. Kudos!

Update! Version 2.0 can do the same for Kerberos keytab files (typically /etc/krb5.keytab).