From: frantz@netcom.com (Bill Frantz)
Date: Tue, 19 Dec 1995 19:06:45 +0800
To: Jeff Weinstein <Jim_Miller@bilbo.suite.com
Subject: Re: Java and timing info - second attempt
Message-ID: <199512190724.XAA10835@netcom22.netcom.com>
MIME-Version: 1.0
Content-Type: text/plain


At 22:31 12/18/95 -0800, Jeff Weinstein wrote:
>  In Netscape Navigator 2.0 Java and JavaScript do not have access
>to crypto routines.  At some point in the future this will probably
>change, but only after we understand the implications much better
>than we do today.

More importantly for covert channel analysis, do they have access to good
clocks?  Access to a good clock could make a Java applet a good candidate
for the receiver in a generalized covert channel attack.  Access to both
process time and real-world time can give a good indication of load on the
processor, and might be needed for animation.  A transmitter could send by
using or not using the CPU.  (Installing the transmitter is left as an
excersize for the student. ;-) )

Who said that life was safe?


-----------------------------------------------------------------
Bill Frantz                   Periwinkle  --  Computer Consulting
(408)356-8506                 16345 Englewood Ave.
frantz@netcom.com             Los Gatos, CA 95032, USA