full-disclosure - Re: Working exploit for Debian generated SSH Keys

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <007701c8b9d8$f8640c80$686b880a@softpro.corp>
Date: Mon, 19 May 2008 13:51:29 -0400
From: "Garrett M. Groff" <groffg@...design.com>
To: <full-disclosure@...ts.grok.org.uk>
Subject: Re: Working exploit for Debian generated SSH Keys

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

I think the "wheel" in this context refers to exploit code, not PRNG code.

Generating pseudo-random numbers isn't hard given a good API, but writing
that API is non-trivial (assuming you want high entropy/low
predictability). And, apparently, screwing up that API is also very easy.

- - G

- ----- Original Message ----- 
From: "Skratz0r" <roryflyguy@...glemail.com>
To: "nicolas vigier" <boklm@...s-attacks.org>
Cc: <full-disclosure@...ts.grok.org.uk>
Sent: Monday, May 19, 2008 7:50 AM
Subject: Re: [Full-disclosure] Working exploit for Debian generated SSH
Keys

> >_>
>
> #1: It cant be that hard to generate random numbers.
> #2: It's hardly the wheel.
> #3: Again, pointless arguments.
>
> On 19 May 2008, at 12:09, nicolas vigier wrote:
>
>> On Mon, 19 May 2008, Ronald van der Westen wrote:
>>
>>> Why reinvent the wheel?
>>
>> Why not ?
>>
>> _______________________________________________
>> Full-Disclosure - We believe in it.
>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>> Hosted and sponsored by Secunia - http://secunia.com/
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/

-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.6.2 (Build 2014) - not licensed for commercial use: 
www.pgp.com

wj8DBQFIMb4YSGIRT5oVahwRAuQXAJ9UkoJplYiA6DiVbeRTbkwTDoovZQCeN7ir
t3YvNW8PRxJh3Fb4VrZ1ZDo=
=+k/9
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/