Re: [Diehard] Overlap sum test
From: Mok-Kong Shen (mok-kong.shen_at_t-online.de)
Date: 09/25/03
- Next message: Mok-Kong Shen: "Re: Book as the key"
- Previous message: katiki_at_kodak.com: "Strange encryption issues using AES algorithm..."
- Maybe in reply to: Cristiano: "[Diehard] Overlap sum test"
- Next in thread: Ernst Lippe: "Re: [Diehard] Overlap sum test"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Thu, 25 Sep 2003 10:56:38 +0200
Cristiano wrote:
>
> Danilo Gligoroski wrote:
> > "Cristiano" wrote:
> >
> > If they fail too on OST (overlaping sum test), then the test is at
> > least buggy, or totaly wrong, and Marsaglia should seriousely consider
> > that.
>
> Have you seen his recent post? He posted the correction function.
> I tested several generators using that correction and now the test is good.
Congratulation to you and Gligoroski for having spent so
much effort and work that finally led to the discovery of
an essential coding error in one of the popular software of
interest to quite a number of readers in our group.
Concerning the general issue of program correctness, I like
to quote from a post of someone in another group who quoted
yet another person:
Fortunately the use of cryptographic programs has become
more widespread and more people use crypto software today
protecting their privacy on the Internet than five years
ago. Unfortunately with crypto products developing they
have become more and more complex and intransparent,
leaving the user in fatal dependence on crypto code almost
nobody fully understands nor analyses for security riscs.
Most people have inevitably accepted this situation and do
not really know what exactly they are doing when they use
crypto software, even though the basic principles are
widely known and the source code is of course open to
inspection and peer review. But as the code grows more and
more complex, it is simply beyond the state of the art to
analyse such complex code with respect to all its security
implications and it is no wonder, that it is being used
with nothing more than a faint hope that some expert had
checked every single line and can be held responsible
for the security of the software system. Although not
every single bit of a software system is security relevant
one can imagine the complexity and interdependency of
current versions of GnuPG (54100 lines of C code) and
PGP-6.5 (294100 lines of C code) compared to classic
PCP (23600 lines of C code).
Those who have ever the experience of looking at a relatively
small piece of code written by someone else but couldn't
understand it despite thinking and re-thinking many many
and many times would certainly lack the courage to even
take a single glance at the source of any software package
of the order of magnitude examplified above, I suppose.
M. K. Shen
- Next message: Mok-Kong Shen: "Re: Book as the key"
- Previous message: katiki_at_kodak.com: "Strange encryption issues using AES algorithm..."
- Maybe in reply to: Cristiano: "[Diehard] Overlap sum test"
- Next in thread: Ernst Lippe: "Re: [Diehard] Overlap sum test"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
