Re: Jetty Session ID Prediction

On Tue, 6 Feb 2007, Chris Anley wrote:

Nice paper, and quite certainly helpful for security testers as far as
showing the weakness of standard library PRNGs to others goes.

The idea is eventually to have a tool that performs point-and-click
identification, analysis and prediction of an unknown source of
"randomness", including LCGs but also more advanced generators such as
the Mersenne twister and SHA1PRNG.

Now not that I want to be obtrusive than I already am (hi mom!), but can very well tell LCGs from
SHA1PRNGs - that and do a bunch of other tricks ;-)