IRC Archive for channel #xwiki

lpereira left at 00:06 (Quit: Leaving.
lucaa joined #xwiki at 00:19
florinciu joined #xwiki at 00:19
DSpair joined #xwiki at 00:24
florinciu left at 00:43 (Read error: Connection reset by peer
DSpair left at 01:52 (Quit: Leaving
CalebJamesDeLisl - (01:57): LadySerena: It sounds like you want to start at the component manager. What specifically do you want to get rid of and what do you want to keep?
LadySerena - (01:59): I want to keep documents, macros, formatting (xwiki/2, plain/1, etc...), versioning, and attachments
LadySerena - (02:00): and get rid of everything else (config, users, theming, etc...)
CalebJamesDeLisl - (02:00): So you'll need to keep the xwiki-core and it's database driver then.
CalebJamesDeLisl - (02:01): I assume you want the renderer, WYSIWYG as well?
LadySerena - (02:03): yar
CalebJamesDeLisl - (02:04): I think the best approach is to remove things which you don't need. What parts of your platform do you want to integrate?
LadySerena - (02:14): well, integrating XWiki into my platform
CalebJamesDeLisl - (02:16): I don't know anything about your platform, where do you intend to have the connection points? Will your platform act as hibernate and manage connection to the database? manage users like LDAP? etc.
LadySerena - (02:19): my platform uses LDAP authentication and does its own database management
CalebJamesDeLisl - (02:23): There is an LDAP plugin which will allow your users to become XWiki users. Getting underneath the database driver will be tougher.
CalebJamesDeLisl - (02:25): Probably the reasonable thing to do is let xwiki-core have it's own database and do integration on other places.
CalebJamesDeLisl - (02:28): If you want access to XWiki services from the outside such as the renderer, all you have to do is register a class with the component manager and declare rendering as a @Requirement.
LadySerena - (02:57): hmm
LadySerena - (02:57): also, the module interface I have is insanely simple: http://vocasystem.net/hudson/job/Rebirth/javadoc/com/varusonline/ext/interfaces/FaceModule.html
CalebJamesDeLisl - (03:06): That it is. I guess what you will need to do is write some sort of adapter between that and XWikiAction.
sdumitriu left at 03:06 (Quit: Leaving.
CalebJamesDeLisl - (03:08): This https://svn.xwiki.org/svnroot/xwiki/platform/core/trunk/xwiki-core/src/main/java/com/xpn/xwiki/web/XWikiAction.java
CalebJamesDeLisl - (03:09): takes a call from struts and outputs a rendered page. It looks like you want to refactor it to take a call from your system. Sound right?
LadySerena - (03:09): yar
LadySerena - (03:10): Rebirth handles requests in 3 steps: request configuration, request processing, content processing
LadySerena - (03:10): and the servlet (rbServlet) adds a 4th step: template processing
penyaskito left at 03:15 (Read error: Connection reset by peer
CalebJamesDeLisl - (03:15): what's the difference between request configuration and request processing?
marta1 left at 03:15 (Ping timeout: 276 seconds
LadySerena - (03:17): in request configuration its making sure all the configuration properties for all the Rebirth plugins are loaded, and it sets the values of the ServiceContext vars
CalebJamesDeLisl - (03:23): A quick rundown of XWikiAction is as follows: set up a new XWikiContext, gets the requested page, does a permission check (slow), puts the page in the context, calls action() which is overridden in the subclass and if action returns true, it calls render in the subclass and takes the result, looks for a template by that name, and parses it.
CalebJamesDeLisl - (03:25): There is a lot of other stuff in there which I think you can safely ignore.
LadySerena - (03:25): so I can have the wrapper module just return raw HTML?
CalebJamesDeLisl - (03:26): sure, one way to do that would be to provide a subclass of the response and provide your own output stream.
LadySerena - (03:26): and I think permissions can be disabled, since Rebirth already handles that (and efficiently!)
CalebJamesDeLisl - (03:27): Not sure just how much you need but you might be able to get away with building the XWikiContext, getting the page and rendering the content.
LadySerena - (03:28): that would be perfect
CalebJamesDeLisl - (03:29): Everything you need is right in XWikiAction, you just want to gut most of the code and replace the struts based stuff with your won input.
CalebJamesDeLisl - (03:30): Unfortunately it's a rats nest. Probably the worst part of the old core.
CalebJamesDeLisl - (03:31): xwiki.prepareDocuments(   <-- That's where the permission check happens.
CalebJamesDeLisl - (03:34): If you were to change the url scheme to site.com?page=Main.WebHome  then you could drop the entire url parsing code and use xwiki.getDocument(request.getParameter('page'))
CalebJamesDeLisl - (03:36): or use the url parsing scheme by calling xwiki.getDocument(xwiki.getDocumentReference(request, context));
CalebJamesDeLisl - (03:37): calling xwiki.prepareResources( is needed for the translations.
LadySerena - (04:01): O.o
CalebJamesDeLisl - (04:03): Maybe best to start at your end and work inward. Will you be providing a URL or getting the page name some other way?
jfx left #xwiki at 05:32
LadySerena - (05:36): the platform provides the URL
CalebJamesDeLisl - (05:38): Grrr 15 years after Bernstein v USA, I still have to download a certificate in order to use pkcs12 with more than 7 character passwords.
LadySerena - (05:38): http://vocasystem.net/hudson/job/RebirthSP/javadoc/com/varusonline/context/ServiceContext.html  <-- it is easy to reconstruct the URL
CalebJamesDeLisl - (05:40): If you want to construct a URL then you can use the url parser, otherwise if you can get a space, page, language, and action some other way then it's easier to skip the URL step.
LadySerena - (05:44): ya, I have a way to get around that
CalebJamesDeLisl - (05:45): Hmm. Everything in java is hackable, I wonder if I can just extend/override/reflect the offending code? Couldn't ship it that way but it would be a fun exercise.
CalebJamesDeLisl - (05:45): (pkcs12 key)
LadySerena - (05:45): essentially, Rebirth separates the URL into nice little bite-size chunks, then each module/endpoint simply acts on one (or more) things
CalebJamesDeLisl - (05:45): So if you have your own URL parser then you should use it.
LadySerena - (05:46): well ya
CalebJamesDeLisl - (05:46): You need the page space, name, language (2 letter code), and the action.
LadySerena - (05:47): awesome
penyaskito joined #xwiki at 06:09
mflorea joined #xwiki at 07:09
mflorea left at 07:21 (Quit: Leaving.
sburjan` joined #xwiki at 07:23
asrfel joined #xwiki at 08:25
mflorea joined #xwiki at 08:27
silviar joined #xwiki at 08:51
arkub joined #xwiki at 09:23
sburjan joined #xwiki at 09:25
lpereira joined #xwiki at 09:33
lucaa left at 09:47 (Ping timeout: 240 seconds
KermitTheFragger joined #xwiki at 09:49
marta1 joined #xwiki at 09:50
lucaa joined #xwiki at 10:08
abusenius joined #xwiki at 10:19
SvenDowideit_ joined #xwiki at 10:22
SvenDowideit left at 10:22 (Ping timeout: 265 seconds
SvenDowideit_ is now known as SvenDowideit ([email protected]
tmortagne joined #xwiki at 10:32
tmortagne left #xwiki at 10:32
Enygma` joined #xwiki at 10:57
penyaskito_ joined #xwiki at 11:06
penyaskito left at 11:07 (Read error: Connection reset by peer
SvenDowideit left at 11:12 (*.net *.split
lucaa left at 11:12 (*.net *.split
evalica joined #xwiki at 11:17
florinciu joined #xwiki at 11:17
SvenDowideit joined #xwiki at 11:18
lucaa joined #xwiki at 11:18
sdumitriu joined #xwiki at 11:22
dfff joined #xwiki at 11:57
dfff - (11:59): hi. how can i display a value while editing inline as a dropdown. i already got the dropdown ready and could now ask for the valie via request.get. but $doc.setproperty wants a basevalue, not a string.
CalebJamesDeLisl - (12:05): Make an html macro and put the form select element in that?
dfff - (12:07): i got something like: #$doc.setProperty('codeSnippetsClass', 'lang', $request.lang)      where codeSnippetsClass is the classname, lang the name of the property and $request.lang the value of the selected dropdown
CalebJamesDeLisl - (12:11): And you want to display that back to the user?
vmassol joined #xwiki at 12:23
dfff - (12:42): CalebJamesDeLisl: eventually, i want to save the selected value from the dropdown as a property.
CalebJamesDeLisl - (12:49): I would use $doc.getObject('codeSnippetClass').set('lang', $request.getParameter('lang'))
CalebJamesDeLisl - (12:50): then $doc.save()
marta1 is now known as marta__ ([email protected]
dfff - (12:54): does $request.parameter work? because there is in 1 document:   {{html}} listcode {{/html}}  and following after that: $request.parameter.     the value hasnt been send when the velocity code already asks for the $request.parameter
florinciu1 joined #xwiki at 12:57
dfff - (12:58): http://pastie.org/1045457
dfff - (12:58): its the part at the end
CalebJamesDeLisl - (13:01): Yes, if there is no field by the name, velocity will try calling get<name>
sdumitriu - (13:01): Nobody available to release 2.4?
CalebJamesDeLisl - (13:02): If get<name> doesn't exist, velocity tries get('<name>')
CalebJamesDeLisl - (13:03): I prefer using getParameter('name') because it's more precise.
dfff - (13:07): CalebJamesDeLisl:   could the code above work?  it doent ge parsed, it just prints out 'as is'
CalebJamesDeLisl - (13:09): Hmm, i must have made a mistake. What I do when that happens is try just the first part eg:  $doc.getObject('codeSnippetClass')
CalebJamesDeLisl - (13:09): it should output Object@12345ABC
dfff - (13:11): nope, still the sourcecode. but the classname is written correctly
CalebJamesDeLisl - (13:16): try with the space name too:   $doc.getObject('Main.codeSnippetClass')   or whatever.
dfff - (13:17): thats it
sdumitriu left at 13:19 (Ping timeout: 264 seconds
abusenius left at 13:54 (Ping timeout: 245 seconds
abusenius joined #xwiki at 13:57
sdumitriu joined #xwiki at 14:03
sburjan - (14:07): sdumitriu, : are you around ?
CalebJamesDeLisl - (14:08): abusenius: I got PKCS12 export working for keys hosted on the server, the problem is (you're not going to believe this) passwords longer than 7 characters throw an error because keys over a certain size are banned in some localities.
sdumitriu - (14:11): sburjan: Yes
abusenius - (14:17): CalebJamesDeLisl: hm, I wonder how we can disable this stupid limitation
jvelo joined #xwiki at 14:18
CalebJamesDeLisl - (14:18): Well you can install this "Unlimited Strength jurisdiction file
CalebJamesDeLisl - (14:19): "
abusenius - (14:19): have you tried that?
abusenius - (14:20): are you allowed to use it in US? :)
CalebJamesDeLisl - (14:21): haha, USA allows any encryption. It used to be that we couldn't export it to you but since Bernstine v USA that has been removed.
abusenius - (14:22): maybe explicitely using BC will help too
CalebJamesDeLisl - (14:22): I have been playing with that. I hit a wall with package private, but I know if I break out reflection, all walls fall down.
abusenius - (14:23): but in principle, if it works with a normal jce policy, then we should leave it like this otherwise using xwiki in a country with strange laws will be illegal
CalebJamesDeLisl - (14:24): The question is do we want to ship something which _might_ be unallowable in certain countries?
CalebJamesDeLisl - (14:24): Yea that.
abusenius - (14:24): we should have a configuration setting for certificate key length because of that I guess
abusenius - (14:25): limited RSA key length is 768 afaik
CalebJamesDeLisl - (14:25): No RSA can be 2048 and that's basically unbreakable.
CalebJamesDeLisl - (14:26): I think they recognized that it would be too much of a pain if they limited RSA.
CalebJamesDeLisl - (14:26): This is triple-des which is limited to 64!
CalebJamesDeLisl - (14:27): So if I can find a way to get longer passwords and it's not an obvious workaround of the block then that's an option.
CalebJamesDeLisl - (14:28): Another option is looking for a different cypher since PKCS12 supports a bunch.
CalebJamesDeLisl - (14:29): A third option is to mangle the password because searching for a 7 byte key is hard while looking for a 7 character password is easy.
CalebJamesDeLisl - (14:29): option 3 means export to browser wouldn't work (but why would you do that?)
CalebJamesDeLisl - (14:29): Also #3 sort of breaks the PKCS12 standard.
abusenius - (14:29): mangling does not really matter, just mangle your keys while brute-forcing
abusenius - (14:30): I'd rather stick to strong crypto by default (like AES)
abusenius - (14:30): and provide an option to obey strong laws
CalebJamesDeLisl - (14:30): If we don't care about following PKCS12 then we could do something really good like a Snuffle implementation.
sdumitriu left at 14:31 (Quit: Leaving.
CalebJamesDeLisl - (14:32): re laws: Explicitly bypassing the limit is not really an option, but using something like curve25519 is more of a grey area.
abusenius - (14:34): if there is a limit on key size, there is not much we can do using other algorithms
abusenius - (14:34): good ones are all over the limit :)
CalebJamesDeLisl - (14:35): No a really good algorithm means shorter keys are stronger.
CalebJamesDeLisl - (14:35): Also the limit is on only a few algorithms.
CalebJamesDeLisl - (14:35): DES 64
CalebJamesDeLisl - (14:35): DESede *
CalebJamesDeLisl - (14:35): RC2 128
CalebJamesDeLisl - (14:35): RC4 128
CalebJamesDeLisl - (14:35): RC5 128
CalebJamesDeLisl - (14:35): RSA 2048
CalebJamesDeLisl - (14:35): * (all others) 128
abusenius - (14:38): what if some other country has other limits?
CalebJamesDeLisl - (14:39): They have to change them if they want to allow java in that contry.
CalebJamesDeLisl - (14:40): *country.
abusenius - (14:40): they have a custom policy for java vm I guess
abusenius - (14:41): (trying to find some overview about limitations)
CalebJamesDeLisl - (14:56): curve25519 uses 256 bit keys but this is a requirement for the standard so I think it would be looked on differently than bypassing a limitation in java.
CalebJamesDeLisl - (14:56): And according to djb, curve25519 is equivalent to RSA 3000 bit keys.
abusenius - (14:59): lets not dig too deep into this, IMO this problem is not worth spending too much time on
abusenius - (15:00): we are safe using strong crypto, and java will throw errors if the current policy is strange
CalebJamesDeLisl - (15:01): Yea, I'm not going to the trouble of implementing 25519 for this (it's not part of BC) the interface is a bunch of functions which take and output byte arrays.
CalebJamesDeLisl - (15:01): I don't care about using 7 byte keys, 7 byte triple des is fine with me, 7 character passwords are very dangerous though.
abusenius - (15:02): I need to test if I can use longer keys
abusenius - (15:02): (I have unlimited policy installed)
CalebJamesDeLisl - (15:03): ahh, I should push the changes then.
CalebJamesDeLisl - (15:04): do you care if I remove signedscripts? I broke it implementing pkcs12 and I have been building with it removed.
CalebJamesDeLisl - (15:05): IMO it doesn't belong in the crypto module anyway.
abusenius - (15:05): dont remove them
abusenius - (15:05): I'll move them to another component
CalebJamesDeLisl - (15:06): They'll still be in the history.
CalebJamesDeLisl - (15:06): you can svn up the old revision and then copy them over.
abusenius - (15:06): its easier to move them then to revert
abusenius - (15:06): (I don't use svn directly)
CalebJamesDeLisl - (15:07): Ok, when you're done I'll commit my latest changes (with the test)
abusenius - (15:07): I fixed some problems since he last time you committed btw
abusenius - (15:07): *the
CalebJamesDeLisl - (15:07): Hmm, I might have to merge then.
sburjan - (15:07): does anyone have any idea where can I get the html code of the javascript notifier when saving/deleteing a comment or attachment ? i need it for automated testing to verifiy the success orfailure of a operation
sburjan - (15:08): Firebug doesnthelp much, because the notifier dissapears too quickly
CalebJamesDeLisl - (15:09): There are tests which use it. You can look at those.
sburjan - (15:10): hmm .. wasn't able to find one .. at least not in the ui-tests
CalebJamesDeLisl - (15:11): Here's the controller for the action buttons: http://svn.xwiki.org/svnroot/xwiki/platform/web/trunk/standard/src/main/webapp/resources/js/xwiki/actionbuttons/actionButtons.js
fmancinelli joined #xwiki at 15:15
abusenius - (15:17): CalebJamesDeLisl: moved them
CalebJamesDeLisl - (15:18): I'm trying out 128 bit rc4
CalebJamesDeLisl - (15:20): Nope it's the password size which seems to have no relation to the key size specified in the cipher
jvelo - (15:21): sburjan check notification.js or confirmationBox.js
sburjan - (15:22): thanks
CalebJamesDeLisl - (15:23): Committed, it's pretty dirty and you can see my attempt at bypassing the limit ;)
dfff left at 15:29 (Quit: Page closed
abusenius - (16:10): CalebJamesDeLisl, you said you've added a test, where is it?
CalebJamesDeLisl - (16:11): right: I added a test but I didn't svn add it.
CalebJamesDeLisl - (16:11): fixed.
asrfel left at 16:13 (Quit: Leaving.
abusenius - (16:17): does this test allready thows an exception about too long key?
CalebJamesDeLisl - (16:17): It does on my machine.
abusenius - (16:18): it works fine for me
abusenius - (16:18): so unlimited jce profile seems to do the trick
CalebJamesDeLisl - (16:19): Yea but will people install it?
abusenius - (16:19): well, if they don'T , they will not be able to use strong crypto in any other java program
CalebJamesDeLisl - (16:20): Most of the time it doesn't matter. Somebody showed a test program which says that RSA keys are unlimited.
abusenius - (16:21): I'd say mention this in install docs should be sufficient
CalebJamesDeLisl - (16:22): What do you expect people to use for the password?
abusenius - (16:23): their weak user password
abusenius - (16:23): :)
abusenius - (16:24): this limitation is something admins using tomcat etc should be aware of
CalebJamesDeLisl - (16:24): meaning the first 7 characters of the password?
CalebJamesDeLisl - (16:25): Or do you plan to write applications which will blow up unless people install the exception.
abusenius - (16:25): tomcat will not be able to use strong crypto in TLS without proper policy for example
abusenius - (16:25): maybe we can check if it is installed?
abusenius - (16:26): and show a big phat warning that we default to first 7 characters?
CalebJamesDeLisl - (16:27): No tomcat will appear to work fine because it will just use RSA-1024/2048+AES128
CalebJamesDeLisl - (16:27): I'd bet most installations are using just that.
abusenius - (16:27): yea, may happen
abusenius - (16:28): unless they use a non-US distro which has it installed by default
abusenius - (16:29): you are using openjdk right?
CalebJamesDeLisl - (16:30): US doesn't really care that much unless you're exporting it. Ironically most of the countries which are against encryption don't have the power to break a 40 bit rsa.
CalebJamesDeLisl - (16:30): Yes OpenJDK.
silviar left at 16:31 (Quit: Leaving.
abusenius - (16:32): well, if you are an US-organization and let people download an .iso, technically you export it
CalebJamesDeLisl - (16:37): Yes and in the old days software (netscape) used to make you promise not to export it. DJ Bernstein created a strong cipher using only a hash function (which had no export regulation) which created a bunch of drama and the government basically gave up.
CalebJamesDeLisl - (16:38): http://en.wikipedia.org/wiki/Snuffle
sburjan left at 17:19 (Remote host closed the connection
mflorea left at 17:25 (Quit: Leaving.
lpereira left at 17:27 (Ping timeout: 260 seconds
marta__ left at 17:37 (Ping timeout: 252 seconds
marta1 joined #xwiki at 17:39
abusenius - (18:11): CalebJamesDeLisl, have you forgot to svn add implementation of UserDocumentUtils? :)
CalebJamesDeLisl - (18:11): hmm probably.
CalebJamesDeLisl - (18:12): thanks, fixed.
abusenius - (18:12): great :)
CalebJamesDeLisl - (18:14): So what do you want to do with pkcs12? the password space is 16 bytes, but because java uses UTF-16, that = 8 characters.
CalebJamesDeLisl - (18:14): We could truncate the password (bad)
CalebJamesDeLisl - (18:15): we could mangle it so we get 16 meaningful bytes.
CalebJamesDeLisl - (18:15): (not exportable)
CalebJamesDeLisl - (18:16): I guess it doesn't matter much at my end, you're implementing the server side stuff.
CalebJamesDeLisl - (18:17): We could add another method of storing the private key. No reason to remove pkcs12, it will just be limited.
abusenius - (18:17): I think using something like md5(pass) is the best
CalebJamesDeLisl - (18:17): That actually makes some sense.
CalebJamesDeLisl - (18:18): md5 is bad.
CalebJamesDeLisl - (18:18): Did you read about snuffle?
abusenius - (18:18): jes
abusenius - (18:18): yes
abusenius - (18:19): but md5 is 128 bit :) we can truncate sha1 to 128 bit
CalebJamesDeLisl - (18:19): It looks easy to implement, the only problem is how fast the hash should roll to keep enough randomness.
abusenius - (18:19): whatever we use, it is better than .toBytes()
CalebJamesDeLisl - (18:21): MD5 can be used to cool stuff....  When other people use it ;) http://www.phreedom.org/research/rogue-ca/
fmancinelli left at 18:21 (Ping timeout: 258 seconds
CalebJamesDeLisl - (18:22): Check you r certificate store, I had that cert on my computer and have no idea where it came from.
abusenius - (18:22): and since someone who wants the secret key by bruteforcing would bruteforce the password and not the hash of it, it really does not matter that much
abusenius - (18:22): I know this one :)
CalebJamesDeLisl - (18:23): The only advantage of hashing the password is you can take bytes from the hash and it will take more of the 16 byte space.
abusenius - (18:23): https://i.broke.the.internet.and.all.i.got.was.this.t-shirt.phreedom.org/
abusenius - (18:24): yes, and it can take a password of any length
CalebJamesDeLisl - (18:24): Yup. when I went there, perspectives had to load the cert because they made their CA expire real quick.
CalebJamesDeLisl - (18:25): should have published the private key ;) that would have gotten the CAs to get their act together.
abusenius - (18:25): and bring them to jail :)
CalebJamesDeLisl - (18:25): tor
CalebJamesDeLisl - (18:26): Yea nothing real funny happens because people want to give peaches and get jobs...
CalebJamesDeLisl - (18:26): s
CalebJamesDeLisl - (18:27): Actually probably not jail unless conspiracy to commit a crime can be proven.
CalebJamesDeLisl - (18:27): Anyway...
abusenius - (18:28): anyway, so since the limitation comes from pkcs12 there is not much we can do
CalebJamesDeLisl - (18:28): Maybe the best thing to do is to have 2 ways of storing keys.
abusenius - (18:28): in principle we could use something else
CalebJamesDeLisl - (18:28): We have pkcs12 and it works with web browsers and other stuff.
abusenius - (18:29): unless we want to export keys
abusenius - (18:29): yes, thats the advantage
lpereira joined #xwiki at 18:29
CalebJamesDeLisl - (18:29): We could add another way which stores the key as base64 and uses encryption which we define.
CalebJamesDeLisl - (18:30): And still retain pkcs12.
abusenius - (18:30): would it work with browsers etc?
CalebJamesDeLisl - (18:30): pkcs12 would but we'd have to warn the user that their password might be trunkated.
abusenius - (18:31): hm, wayt, jce policy still affects the limitiation
abusenius - (18:31): so the problem is really the configuration
CalebJamesDeLisl - (18:31): rsa-4096 ;)
CalebJamesDeLisl - (18:32): Or a snuffle implementation.
abusenius - (18:32): no
abusenius - (18:32): standard, known crypto
abusenius - (18:32): = AES
CalebJamesDeLisl - (18:33): http://ykyuen.wordpress.com/2010/04/22/java-cryptography-extension-check-maximum-allowed-key-size/
CalebJamesDeLisl - (18:33): That guy shows key size limits for different algorithms.
CalebJamesDeLisl - (18:34): triple-des with the key size limit is fine with me, it's the password size limit which is such a pain.
abusenius - (18:35): AES                   : 2147483647bit
abusenius - (18:35): DES                   : 2147483647bit
abusenius - (18:35): DESEDEWRAP            : 2147483647bit
abusenius - (18:35): PBEWITHSHA1ANDRC2_40  : 2147483647bit
abusenius - (18:35): :)
CalebJamesDeLisl - (18:36): Hmm, I should try running that to see what I get..
abusenius - (18:36): install sane jce policy and forget about it
CalebJamesDeLisl - (18:37): nobody will do that. it's harder than installing a browser cert.
abusenius - (18:37): using a limited java version I get the same results as on the page
abusenius - (18:37): well, too bad
abusenius - (18:38): if the person who runs the server does not want security, nobody can help him
abusenius - (18:38): does this affect the key size in client certificates?
abusenius - (18:39): (assuming the client has installed the policy)?
abusenius - (18:39): probably no right, RSA seems to be not affected
CalebJamesDeLisl - (18:40): No, firefox generates a 2048 bit RSA key. Because it's RSA, java has no problem signing it.
abusenius - (18:40): so it is just storing the certificates
CalebJamesDeLisl - (18:41): It signs the cert and stores it. It also generates another key to sign with.
abusenius - (18:41): I'd say we should document it rather that inventing wworkarounds, especially since in some countries, even using strong crypto is not allowed
abusenius - (18:42): hm, I wonder if BC also implements this limitation
CalebJamesDeLisl - (18:42): Actually the funny thing is I didn't see any country on the list which made those distinctions, they either allow crypto or they ban/license it.
CalebJamesDeLisl - (18:43): re workarounds: 128 bit 3des (the actual limit) is fine, what bothers me is 7 character passwords.
abusenius - (18:45): why not 128 bit aes?
abusenius - (18:46): it is faster and less broken
CalebJamesDeLisl - (18:46): slow has it's advantages, less broken you say? has des been broken?
Enygma` left at 18:47 (Quit: Leaving.
abusenius - (18:47): yes
abusenius - (18:47): (partially)
abusenius - (18:48): and aes is really better
CalebJamesDeLisl - (18:48): It seems that the internet agrees.
abusenius - (18:48): with BC all symmetric ciphers are limited to 128 bit
abusenius - (18:49): (w/o policy)
abusenius - (18:49): which is quite good actually
evalica left at 18:50 (Quit: Leaving.
CalebJamesDeLisl - (18:50): Of course anyone could just create 2 keys and encrypt with one then the other. not quite 256 but a definite improvement.
CalebJamesDeLisl - (18:51): But it's true for symmetric cyphers, 128 is quite adequate.
CalebJamesDeLisl - (18:53): Hmm. xwikisas.com uses aes-256. Figures...
CalebJamesDeLisl - (18:53): Google uses rc4-128
abusenius - (18:54): probably because it's faster :)
abusenius - (18:54): and I think this is the default TLS cipher, which has to be supported by everyone
abusenius - (18:55): ok, need to go home, see ya later
CalebJamesDeLisl - (18:55): see ya.
abusenius left at 19:06 (Ping timeout: 240 seconds
florinciu left at 19:06 (Read error: Connection reset by peer
KermitTheFragger left at 20:03 (Quit: Leaving
abusenius joined #xwiki at 20:14
CalebJamesDeLisl - (20:31): abusenius: Do you want to implement a password mangling function? It could detect the limit and the long password and then just sha1 it.
CalebJamesDeLisl - (20:48): I'm going to bed, see you tomorrow.
jvelo left at 20:57 (Ping timeout: 245 seconds
florinciu1 left at 21:07 (Quit: Leaving.
mflorea joined #xwiki at 21:08
florinciu joined #xwiki at 21:18
tmortagne joined #xwiki at 21:18
tmortagne left #xwiki at 21:19
marta1 left #xwiki at 21:39
mflorea left at 22:02 (Quit: Leaving.
fmancinelli joined #xwiki at 22:21
florinciu left at 22:25 (Quit: Leaving.
lucaa left at 23:01 (Ping timeout: 260 seconds
lucaa joined #xwiki at 23:19
fmancinelli left at 23:28 (Ping timeout: 276 seconds