cryptoanarchy.wiki

Arise, you have nothing to lose but your barbed wire fences!

1995-09-19 - Re: NYT on Netscape Crack

Header Data

From: m5@dev.tivoli.com (Mike McNally)
To: Eric Young <eay@mincom.oz.au>
Message Hash: 001d1dfe5ac7ac28030d7dd0241deb6489b916a6a690f84117f1d9c11577d4a8
Message ID: <9509191238.AA09042@alpha>
Reply To: <43lu3k$7q6@tera.mcom.com>
UTC Datetime: 1995-09-19 12:40:36 UTC
Raw Date: Tue, 19 Sep 95 05:40:36 PDT

Raw message

From: m5@dev.tivoli.com (Mike McNally)
Date: Tue, 19 Sep 95 05:40:36 PDT
To: Eric Young <eay@mincom.oz.au>
Subject: Re: NYT on Netscape Crack
In-Reply-To: <43lu3k$7q6@tera.mcom.com>
Message-ID: <9509191238.AA09042@alpha>
MIME-Version: 1.0
Content-Type: text/plain



Eric Young writes:
 > >   Sigh.  For your information the security code for 1.x versions of
 > > netscape was not even written by someone from NCSA.  The current
 > > security team (which does not include the person who did the 1.x
 > > version) also does not include anyone from NCSA.  While I can't
 > 
 > I will defend Netscapes code on the point about the RNG even though I 
 > have not seen any.  I assume the Netscape code is quite large and each 
 > release would have to pass various fuctionality tests.  How can you test 
 > that the RND seeding is wrong?

The seeding isn't "wrong"; it's a design flaw.  (At least that's my
understanding; maybe I missed something.)

 > You have to actually look at the code, the  number coming out are
 > still random.

Two words: "design review".

 > This sort of error can only be checked by reading the code and
 > specifically looking at critical routines like this the RNG seeding
 > routines.

Uhh... OK.  Sounds like a plan to me.  For critical pieces of code
like that, having repeated exhaustive design/implementation reviews
should be a matter of course.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| Nobody's going to listen to you if you just | Mike McNally (m5@tivoli.com) |
| stand there and flap your arms like a fish. | Tivoli Systems, Austin TX    |
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Thread