Re: Fw: PasswordSafe 3.0 weak random number generator allows key recovery attack



Markus Jansson wrote:
PasswordSafe 3.0 utilizes two different random number generator (RNG)
functions: Win32 API RtlGenRandom() and standart Visual C++ rand().
RtlGenRandom() is not available on Windows prior to Windows XP (i.e.
Windows 2000, Windows NT, Windows Me) so rand() is used instead.
Specifically, rand() is used to generate 256-bit database encryption
key. It is widely known that using rand() in cryptographic
applications is not secure due to its predictbility and small
internal state.
...

I wonder how many people using Password Safe 3.0 would be using anything older than Windows XP?

--
*Adam W. Montville, CISSP*
awm@xxxxxxxxxxxxxxxxxxxxx
*ICQ: 271-685-874*
.



Relevant Pages

  • Re: Fw: PasswordSafe 3.0 weak random number generator allows key recovery attack
    ... Win32 API RtlGenRandom() and standart Visual C++ rand. ... Why didn't they utilize CryptGenRandom? ... Windows 95 OSR2 and it exists specifically for cryptographical purposes. ...
    (sci.crypt)
  • Re: Fw: PasswordSafe 3.0 weak random number generator allows key recovery attack
    ... Win32 API RtlGenRandom() and standart Visual C++ rand. ... Why didn't they utilize CryptGenRandom? ... Windows 95 OSR2 and it exists specifically for cryptographical purposes. ...
    (sci.crypt)
  • Re: VFP9 Anwendung unter Windows 98
    ... Ich habe inzwischen einiges versucht und habe festgestellt, dass die Toolbar ... am linken oder rechten Rand angedockt ... >> Unter Windows 2000 und XP laufen sie. ... Prev by Date: ...
    (microsoft.public.de.fox)
  • Re: srand() inkernel mode
    ... if you are in Windows 2000+, since rand and srand are not thread safe there. ... Don Burn (MVP, Windows DDK) ... > Does anyone have a suggestion for seeding randin a kernel mode driver? ... > In user mode or application layer, it is common to srand, but> the system time is not available in kernel mode. ...
    (microsoft.public.development.device.drivers)
  • Re: JMenu Border
    ... Wer generiert diesen Rand und wofür ist er eigentlich vorgesehen? ... sieht unter Windows so aus, ... Starte die JGoodies Looks Demo, ...
    (de.comp.lang.java)