Re: /dev/random is probably not
From: Glynn Clements (glynn_at_gclements.plus.com)
Date: 07/05/05
- Previous message: Anything But Microsoft: "Passwords in RAM dumps [formally Novell GroupWise Plain Text Password Vulnerability.]"
- In reply to: Zow: "Re: /dev/random is probably not"
- Next in thread: ChayoteMu: "Re: /dev/random is probably not"
- Reply: ChayoteMu: "Re: /dev/random is probably not"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Tue, 5 Jul 2005 15:59:28 +0100 To: "Zow" Terry Brugger <zow@llnl.gov>
"Zow" Terry Brugger wrote:
> It's been a while since I looked at the /dev/random design on Linux
> (probably the early 2.4 days), however one thing that was quite
> clear was that they did not use any network I/O as entropy sources
> because an attacker, particularly one that already had control of
> other machines on the same LAN segment, could have a high degree of
> control over that source.
They don't need to have any control; simply being able to observe
network traffic means that it is no longer random (in the sense of
"unpredictable", which is what counts from a security perspective).
-- Glynn Clements <glynn@gclements.plus.com>
- Previous message: Anything But Microsoft: "Passwords in RAM dumps [formally Novell GroupWise Plain Text Password Vulnerability.]"
- In reply to: Zow: "Re: /dev/random is probably not"
- Next in thread: ChayoteMu: "Re: /dev/random is probably not"
- Reply: ChayoteMu: "Re: /dev/random is probably not"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
