Re: Encryption software integrity test

From: Unruh (unruh-spam_at_physics.ubc.ca)
Date: 06/22/05 

Date: 22 Jun 2005 00:01:21 GMT

>>>
>>>I have been an active user of many different encryption software
>>>products available to general public, but have not yet seen a good
>>>solution for checking the software's integrity before or during use,
>>>or at start up of the software. I am refering to a test that can
>>>prevent the software being subversed, changed, manipulated by a virus
>>>or otherwise, or at least inform thr user that such an attack has
>>>taken place.

YOu cannot. You can check that your particular implimentation is the same
as it was (md5, tripwire, sha256,....) but to test that an encryption
product really is secure can only be done by reading the source code,
compiling against test vectors (randomly generated) and replacing the
encryption code and key generation code with known good stuff. The whole
purpose of even weak crypto is that the output is a random stream.
People have shown for example that with RSA one can encode the key pair
into the output in such a way that it is undiscoverable by anyone except
someone who knows how it was done. The only way you could discover it is by
looking at the source code, and recompiling the source code yourself on a
safe compiler.

>>
>>

Relevant Pages

  • Re: Encrypted software backups?
    ... The more you spread it around, ... I'd encrypt the source code before distributing copies of it to ... Although good encryption would minimize the ... copies among friends and relatives. ...
    (sci.crypt)
  • US crypto export regs (was Re: Use of Debian For Non-Profits)
    ... We're trying to find a version of Linux that we could ... > current encryption. ... is subject to an express agreement for the payment of a license fee ... from the compiling of such source code is also eligible for License ...
    (Debian-User)
  • Re: U.S. export laws on SSH/SSL?
    ... >]> Notifying the BXA that you provide encryption source code can be done ... these loose regulations only apply to freely available source ... regular basis to restrict encryption even further, ...
    (comp.os.linux.security)
  • Re: Encryption software integrity test
    ... product really is secure can only be done by reading the source code, ... encryption code and key generation code with known good stuff. ... purpose of even weak crypto is that the output is a random stream. ...
    (sci.crypt)
  • Re: Need help evaluating proposed encryption architecture.
    ... than storing the key in the source code. ... reverse engineering is not a hard to do as most of us would want ... the decryption routine in Anakrino. ... > b) each encryption uses a different/random IV ...
    (microsoft.public.dotnet.security)