full-disclosure - PFW and Program Correctness

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

From: JMC13 at mail3.cs.state.ny.us (Clairmont, Jan)
Subject: PFW and Program Correctness

I agree combinatorial is probably a better factor of growth of possible
security errors.

Maybe an algorithm like  Port Numbers Open factorial times the number of
applications on those ports factorial times number of code lines ! = number
of possible bugs-vulnerabilities.

Apps! * Ports! * Code Lines! = Possible Security Vulnerabilities or some
combinatorial proof a! * p! * c ! = s.  Call it the the Clairmont-Everhart
Security Index of Vulnerability. The CSIV number, Nice point.

Factor in code lines too 8->, oh well so much for my dreams of being a
mathematician.

Anyone done this?  I think there can ever be enough testing, and I think
if someone is dedicated enough an exploit can be found.  I just think a
system becomes so hardened that the effort to exploit it or break it becomes
too onerous to do.  Where as 1 billion monkeys pushing keys, someone is
going to stumble onto something, a key sequence timing error or other
weird combination of events that finds another bug or security hole.

Jan