bugtraq - Re: Jetty Session ID Prediction

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.58.0702060918270.30846@dione>
Date: Tue, 6 Feb 2007 09:20:33 +0100 (CET)
From: Michal Zalewski <lcamtuf@...ne.ids.pl>
To: Amit Klein <aksecurity@...il.com>
Cc: NGSSoftware Insight Security Research <nisr@...software.com>,
	bugtraq@...urityfocus.com
Subject: Re: Jetty Session ID Prediction

On Tue, 6 Feb 2007, Amit Klein wrote:

> I don't think that the method described in the paper you referenced
> above is applicable as-is [...] (only 32 bits out of the 48 are known).

There are attacks published for just about any variant of LCG imaginable,
including ones with missing MSB/LSB output bits, etc. But I had a chance
to talk to David Litchfield and Chris Anley off the list, and they do use
an algorithmic approach, not brute force - that was simply a poor choice
of words.

/mz