full-disclosure - windows linux final study

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <200504071818.j37IIv8b020266@turing-police.cc.vt.edu>
Date: Thu Apr  7 19:19:09 2005
From: Valdis.Kletnieks at vt.edu (Valdis.Kletnieks@...edu)
Subject: windows linux final study 

On Thu, 07 Apr 2005 11:23:31 CDT, Adam Jones said:
> If your read the full message that you were replying to you would see
> that he addressed this issue in his reply. Vested interest and the
> parties responsible for funding research have no consequence if:
>  
> 1) The methods employed are fully documented.
> 2) The results are fully reproducable.
> 3) The methods are acceptable as an unbiased appraisal of the situation.

Of course, in the real world, the important question is "How subtle were they
in slanting the question in order to get the answer they wanted?".

> To answer your (probably rhetorical) question: yes, I would trust the
> results of smartcard research by the manufacturer if they can prove
> the above three points to my satisfaction.

The problem is that it's often hard to directly map from "Is the research
valid?" (i.e. fulfilling your 3 points above) to "Is this research actually
applicable?".  If the smartcard vendor runs a test that "proves card XYZ is
invulnerable to attacks A, B, and C", that probably means that it's suitable
for use in environments that only have those 3 attacks.  If, however, your
environment also needs to survive attack D, and the test was designed to
not assess the strength against D because the vendor knew their card sucked
at stopping attack D, you may be dissapointed....

Remember - *most* of the sponsored research is "valid".  However, most also
has been tweaked in the problem definition in order to slant the results - and
the challenge is determining if the tweaked definition is still applicable.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 226 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20050407/f041a866/attachment.bin