full-disclosure - Sidewinder G2

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

From: dave at 0dayspray.com (David Maynor)
Subject: Sidewinder G2

On Tue, Nov 18, 2003 at 02:50:13PM -0500, Valdis.Kletnieks@...edu wrote:
> "Testing can prove the presence of flaws, but not their absence" -- Dijkstra.
> 
> The same exact logic of why a crypto challenge doesn't prove anything
> applies to a firewall challenge as well.

Lets take a example. I have firewall A that uses crypto method B.
Cryptalanysis against B will not prove that the firewall implemented it
properly. On the flip side failing to comprimise the firewall will not
prove the method B is sound. 

The logic maybe the same but the implementation of the logic is
diffrent. The reasons that were mentioned in the article applies to
crypto far more than vulndev of products.