Replies welcome.
+ 07:55 [3972] outgoing session with vert.synchro.net:24554 [71.95.196.34]
Replies welcome.
@TZUTC: -0800
@MSGID: 3839.fidotest@1:103/705 1efe11b4
@PID: Synchronet 3.17a-Win32 Debug Feb 20 2018 MSC 1800
@TID: SBBSecho 3.03-Win32 r3.70 Feb 22 2018 MSC 1800
Replies welcome.
digital man
Synchronet "Real Fact" #49:
Synchronet program was named 'sbbs' instead of 'sync' to avoid conflict w/Unix. Norco, CA WX: 50.5oF, 75.0% humidity, 6 mph E wind, 0.00 inches rain/24hrs
--- SBBSecho 3.03-Win32
* Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)
SEEN-BY: 11/0 103/705 114/485 116/116 120/302 340 419 544 546 601 640 123/25
SEEN-BY: 123/141 150 135/300 153/7715 154/10 203/0 218/700 220/0 40 50 70 SEEN-BY: 221/0 226/70 301 350 227/0 60 70 229/426 240/1661 5832 261/38 SEEN-BY: 280/464 5003 5555 310/31 331/51 423/120 712/848 770/1 2215/15 300 SEEN-BY: 2215/1701 2320/0 1 100 102 103 200 3634/12 15 22 24 27 50 119 666 SEEN-BY: 5020/830
@PATH: 103/705 280/464 2320/100 120/544 3634/15 12
Replies welcome.
Replies welcome.
digital man
Synchronet "Real Fact" #49:
Synchronet program was named 'sbbs' instead of 'sync' to avoid
conflict w/Unix. Norco, CA WX: 50.5?F, 75.0% humidity, 6 mph E
wind, 0.00 inches rain/24hrs --- SBBSecho 3.03-Win32
- Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)
@TZUTC: -0800
@MSGID: 3839.fidotest@1:103/705 1efe11b4
@PID: Synchronet 3.17a-Win32 Debug Feb 20 2018 MSC 1800
@TID: SBBSecho 3.03-Win32 r3.70 Feb 22 2018 MSC 1800
Replies welcome.
w/Unix.Norco, CA WX: 50.5oF, 75.0% humidity, 6 mph E wind, 0.00 inches
rain/24hrs--- SBBSecho 3.03-Win32
* Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)Looks good here
SEEN-BY: 222/2 261/38 263/1
ATH: 103/705 280/464 2320/100 261/38 222/2 263/1
On 2018 Mar 01 20:01:56, you wrote to All:
Replies welcome.
+ 02 Mar 10:38:10 [9092] call to 1:103/705@fidonet
02 Mar 10:38:11 [9092] trying vert.synchro.net [71.95.196.34]...
02 Mar 10:38:11 [9092] connected
+ 02 Mar 10:38:11 [9092] outgoing session with vert.synchro.net:24554 [71.95.196.34]
- 02 Mar 10:38:12 [9092] OPT CRAM-MD5-093c975edb2db8401522f7100689992a7509cc 84ebfe8273d3cdff9644d061a00e449bdb73b77fb196b995236c8fc52a71b82f2eb461fa2ed9 32d728b649acb7 CRYPT
FWIW: that's the longest CRAM-MD5 i've seen since i started using binkd/binkp... all the others we've seen (grepped 2015-2018 binkd logs just because) have been 32 characters long... i just found it interesting :)
- 02 Mar 10:38:12 [9092] OPT
CRAM-MD5-093c975edb2db8401522f7100689992a7509cc
84ebfe8273d3cdff9644d061a00e449bdb73b77fb196b995236c8fc52a71b82f2eb461f
a2ed932d728b649acb7 CRYPT
FWIW: that's the longest CRAM-MD5 i've seen since i started using
binkd/binkp... all the others we've seen (grepped 2015-2018 binkd logs
just because) have been 32 characters long... i just found it
interesting :)
That was a helpful observation.
As it turns out, although the spec (FTS-1027) allows for CRAM
challeges up to 64 bytes (128 hex-nibbles) in length, Internet Rex
only uses the first 16 bytes (32 hex-nibbles) of the challenge. So
we've had to reduce the challege size down to 16-bytes because it's unlikely IRex is going to be fixed anytime soon. :-(
On 2018 Mar 06 23:55:34, you wrote to me:
- 02 Mar 10:38:12 [9092] OPT
CRAM-MD5-093c975edb2db8401522f7100689992a7509cc
84ebfe8273d3cdff9644d061a00e449bdb73b77fb196b995236c8fc52a71b82f2eb461f
a2ed932d728b649acb7 CRYPT
FWIW: that's the longest CRAM-MD5 i've seen since i started using
binkd/binkp... all the others we've seen (grepped 2015-2018 binkd logs
just because) have been 32 characters long... i just found it
interesting :)
That was a helpful observation.
i'm glad i wrote the post about it... i started not to but then got curious and
ran the grep to see... out of 388450 samples, none were shorter than 32 characters and only one, the one above, was longer... kinda makes one wonder "why?" and "what language limitations caused this?"...
(aka linked node in sbbsecho speak) where you can say that the remote is using mailer X so your mailer will use limited/ranged capabilities with the remote when negotiation a connection... in other words, a true/false setting in binkit
if the setting is true, a reduced/chopped CRAM-MD5 is sent otherwise the full form is sent... this is also handy for binkp 1.0 vs 1.1 which IREX has a partial implementation of 1.1, IIRC...
like i say above, i don't know if i agree with it or not but it is a workable idea... it could turn into a selection from a list if more mailers are found to
be flawed in similar fashion...
it would be really really really huge if charles were to come back with a fixed
IREX...
That was a helpful observation.
i'm glad i wrote the post about it... i started not to but then got
curious and ran the grep to see... out of 388450 samples, none were
shorter than 32 characters and only one, the one above, was longer...
kinda makes one wonder "why?" and "what language limitations caused
this?"...
Here's my guess:
It's not a language limitation.
Binkd is the reference implementation and likely Irex just followed Binkd's example, which was to send a 16-byte (32-char) CRAM-MD5
challenge - always. Now Binkd will *accept* a longer CRAM-MD5 challege from the binkp-peer (when making outgoing connections), but it'll
never generate one.
So either Irex's binkp implementation was written before any formal specification was published or the author just didn't read the spec
and instead just testd with binkd and only ever *expected* a 16-byte challenge and only used the first 16-bytes (32 hex-chars) when
calculating the HMAC response.
(aka linked node in sbbsecho speak) where you can say that the remote
is using mailer X so your mailer will use limited/ranged
capabilities with the remote when negotiation a connection... in
other words, a true/false setting in binkit
if the setting is true, a reduced/chopped CRAM-MD5 is sent otherwise
the full form is sent... this is also handy for binkp 1.0 vs 1.1
which IREX has a partial implementation of 1.1, IIRC...
like i say above, i don't know if i agree with it or not but it is a
workable idea... it could turn into a selection from a list if more
mailers are found to be flawed in similar fashion...
We just went with the shorter challenge for all links. It's not like
this protocol is very secure anyway. :-)
it would be really really really huge if charles were to come back
with a fixed IREX...
If there are other issues with it that I'm not aware of.
This one particular flaw isn't really all that critical. Perhaps the
FTSC specifications should be updated with a caveat however (e.g.
"16-byte CRAM challenges should be sent for maximum binkp-mailer compatiblity"). Right now the specs just saw between 8 and 64 bytes
with no direction on what a typical implementation *should* use for a challenge length (hint: it's not 8 and it's not 64!).
i've been trying to remember the other one... IIRC, it is something to do with the turn-around in binkp 1.1... when a batch is sent to the remote, a scan is done to see if new mail has been created... if there is new mail, it goes ahead
and sends it in this session rather than terminating and connecting again... Mystic's author ran into it when he implemented binkp 1.1... so you might want that switch to be able to control this, too... "this" being that with IREX, binkit only does binkp 1.0 with IREX even if it advertises binkp 1.1 capability... that is if/when binkit gets binkp 1.1 capability if it doesn't have it already -=B-)
yes, it probably should... we (TINW) probably should toss this into the FTSC-PUBLIC echo and see what sticks to the wall :)
i've been trying to remember the other one... IIRC, it is something to
do with the turn-around in binkp 1.1... when a batch is sent to the
remote, a scan is done to see if new mail has been created... if there
is new mail, it goes ahead and sends it in this session rather than
terminating and connecting again... Mystic's author ran into it when he
implemented binkp 1.1... so you might want that switch to be able to
control this, too... "this" being that with IREX, binkit only does
binkp 1.0 with IREX even if it advertises binkp 1.1 capability... that
is if/when binkit gets binkp 1.1 capability if it doesn't have it
already -=B-)
Binkit already does BinkP 1.1. I'm not really sure how backward
compatible it may or may not be with a strictly 1.0 implementation.
yes, it probably should... we (TINW) probably should toss this into the
FTSC-PUBLIC echo and see what sticks to the wall :)
Yeah, "we" should do that. :-)
yes, it probably should... we (TINW) probably should toss this into the
FTSC-PUBLIC echo and see what sticks to the wall :)
Yeah, "we" should do that. :-)
and the first response over there seems to totally miss the point of the post... that's rather normal :rolleyes:
yes, it probably should... we (TINW) probably should toss this into
the FTSC-PUBLIC echo and see what sticks to the wall :)
Yeah, "we" should do that. :-)
and the first response over there seems to totally miss the point of
the post... that's rather normal :rolleyes:
Yup. Could've predicted that. And then he goes on about MD5
collisions. What'evs. :-)
| Sysop: | Winzlo |
|---|---|
| Location: | Minnesota, USA |
| Users: | 11 |
| Nodes: | 16 (0 / 16) |
| Uptime: | 495929:22:26 |
| Calls: | 82 |
| Files: | 1,070 |
| D/L today: |
27 files (11,920K bytes) |
| Messages: | 286,852 |