OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Re: crypto FTP
From: Jack Lloyd (lloydchimera.acm.jhu.edu)
Date: Tue Jul 25 2000 - 11:06:17 CDT

On Tue, 25 Jul 2000, malekith wrote:

> i worte secure (encrypted) version of ftp protocol. it has nothing to do
> with ssh, but uses similar mechnisms for key exchange and block
> encryption. i'll be glad to hear whatever rc4 cipher (arcfour)
> is safe (whatever to set it default cipher?).

Given a big enough key (128 bits is fine), then RC4 is secure (as far as
anyone knows at this point, anyway). However, it would be a good idea to
ensure that the same key is not used in both directions, a lot of MS stuff
has been found vulnerable to attacks because they use the same RC4 key
each way. Also RC4 is fast, which is good if you're encrypting the bulk
data transfer. Probably giving people the option of 3DES or Blowfish or
something would be good though.

> also it'll be nice if someone have a look at it ;)

Alas, real work calls. :)

J