cryptoanarchy.wiki

Arise, you have nothing to lose but your barbed wire fences!

1995-09-19 - Re: NYT on Netscape Crack

Header Data

From: Eli Brandt <eli@UX3.SP.CS.CMU.EDU>
To: cypherpunks@toad.com
Message Hash: 38921588f3fc713dd3ca530ab73a108c15f2f913d645fb1353772b78e89655bb
Message ID: <9509191438.AA16172@toad.com>
Reply To: <199509190300.XAA05027@pipe4.nyc.pipeline.com>
UTC Datetime: 1995-09-19 14:38:57 UTC
Raw Date: Tue, 19 Sep 95 07:38:57 PDT

Raw message

From: Eli Brandt <eli@UX3.SP.CS.CMU.EDU>
Date: Tue, 19 Sep 95 07:38:57 PDT
To: cypherpunks@toad.com
Subject: Re: NYT on Netscape Crack
In-Reply-To: <199509190300.XAA05027@pipe4.nyc.pipeline.com>
Message-ID: <9509191438.AA16172@toad.com>
MIME-Version: 1.0
Content-Type: text/plain


>    The New York Times, September 19, 1995, pp. A1, D21.
...
>    Netscape officials said today that they would strengthen
>    the system, by making it significantly harder to determine
>    the random number at the heart of their coding system. They
>    said they would no longer disclose what data would be used
>    to generate the random numbers.

and from the WSJ article:

> "The information we were using to create the key is now a known set of
> information," said Jeffrey Treuhaft, security product manager for Netscape.

It sounds as if Netscape thinks that public knowledge of the key
generation is part of the problem.  I hope somebody on the security
team convinces management that entropy is more important than publicity.

(This could be a result of journalistic cluelessness, but it came up in
two independent articles.  It's enough to worry me.)

--
   Eli Brandt
   eli+@cs.cmu.edu
(back from a nice long mailing-list vacation -- it's nice to see that
 cpunks is still at the cutting edge.  for them what cares, I'm now
 a Ph.D. student at the CMU CS program...)

Thread