Re: My own e-mail encryption solution

"Boon" <root@localhost> wrote in message news:4973a517$0$11790$426a74cc@xxxxxxxxxxxxxxx
Joseph Ashwood wrote:

With cryptography, the devil is very much in the details. A seemingly innocent thing like making sure the RAM is initialized, Debian learned this the hard way with their OpenSSL.

It is not my understanding that Debian's problem came from not "making sure the RAM is initialized".

http://research.swtch.com/2008/05/lessons-from-debianopenssl-fiasco.html

It is quite useful to go to the original source of the bug and the fix.

The problem came when Purify and valgrind was run against the code. Purify/valgrind detected that memory was being used prior to initialization (apparently openssl has a few thousand of these "errors"). The "fix" was to initialize the code that Purify/valgrind highlighted, the initialization led to the entropy pool remaining almost empty. This fixed the purify/valgrind error, but in exchange eliminated all security.

The original informtion can be found at
http://lists.debian.org/debian-security-announce/2008/msg00152.html
http://isc.sans.org/diary.html?storyid=4421
http://www.debian.org/security/2008/dsa-1571
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0166

Combined these discuss not just the problem, but the solution.
Joe

.

Relevant Pages

  • Re: romimage problem
    ... I removed the "static" specification from variable declarations to ... or it's romimage that stores the initialization data in the wrong ... RAM 000B0000 00010000 RAM ...
    (microsoft.public.windowsce.platbuilder)
  • Re: IAR compiler & MSP430 problem
    ... Since the array for initialized data only, that means, I've ... The arrays are located in flash memory and don't use any of your RAM ... The initialization routine doesn't have to copy the initialization ...
    (comp.arch.embedded)
  • Re: BlockROM inference in XST - This is just plain silly
    ... release of ISE has support for "synchronously controlled initialization ... of the RAM data outputs" (pg 218 of XST User Guide) and for RAM ... if RISING_EDGE(Clk) then ...
    (comp.arch.fpga)
  • BlockROM inference in XST - This is just plain silly
    ... As part of a re-engineering of a 15 year old product, I need a ROM ... release of ISE has support for "synchronously controlled initialization ... of the RAM data outputs" and for RAM ... if RISING_EDGE(Clk) then ...
    (comp.arch.fpga)
  • Re: Downloading external data file to FPGA
    ... so that when you configure the FPGA the RAM is initialised with the ... without having to iterate through synthesis and PAR. ... processor in the bit stream. ... compile different RAM initialization data and compare the ...
    (comp.arch.fpga)
Quantcast