bugtraq - Re[2]: A new TCP/IP blind data injection technique?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <12216304156.20031213015956@c2i.net>
Date: Sat, 13 Dec 2003 01:59:56 -0800
From: Marius Huse Jacobsen <mahuja@....net>
To: bugtraq@...urityfocus.com
Subject: Re[2]: A new TCP/IP blind data injection technique?

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hello Valdis,

Thursday, December 11, 2003, 9:06:26 AM, you wrote:

VKve> However, it's a trivial matter to take the original text, the replacement text,
VKve> and compute an original such that the checksum comes out "the same".

Only this is a scenario where we don't have the "original text". If we
had, we could have just ripped out the sequence numbers and skipped
the whole problem.

As long as we don't know anything of the original data we have to
guess the correct checksum.

Still, 1 of 65535 is a lot better than... what is it, 2**64 ?

- --
Best regards,
 Marius                            mailto:mahuja@....net

-----BEGIN PGP SIGNATURE-----

iQA/AwUBP9rjLJfZ2CSWpu1rEQIDnwCeI0wMODSSAJLgob1jSl+IDFw3uWMAoLhM
zR9zJ8TPn/0lOWXgJvBq2lZG
=CvFw
-----END PGP SIGNATURE-----