bugtraq - Re: Jetty Session ID Prediction

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.58.0702061906010.30846@dione>
Date: Tue, 6 Feb 2007 19:10:49 +0100 (CET)
From: Michal Zalewski <lcamtuf@...ne.ids.pl>
To: bugtraq@...urityfocus.com
Subject: Re: Jetty Session ID Prediction

On Tue, 6 Feb 2007, Chris Anley wrote:

> http://www.ngssoftware.com/research/papers/Randomness.pdf

Nice paper, and quite certainly helpful for security testers as far as
showing the weakness of standard library PRNGs to others goes.

> The idea is eventually to have a tool that performs point-and-click
> identification, analysis and prediction of an unknown source of
> "randomness", including LCGs but also more advanced generators such as
> the Mersenne twister and SHA1PRNG.

Now not that I want to be obtrusive than I already am (hi mom!), but
http://lcamtuf.coredump.cx/stompy.tgz can very well tell LCGs from
SHA1PRNGs - that and do a bunch of other tricks ;-)

/mz