full-disclosure - Re: Creating a rogue CA certificate

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <2a66a350812301649u17102787x9e6e9d1b7f6bfdd5@mail.gmail.com>
Date: Tue, 30 Dec 2008 16:49:43 -0800
From: chort <chort0@...il.com>
To: Valdis.Kletnieks@...edu
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Creating a rogue CA certificate

On Tue, Dec 30, 2008 at 4:27 PM,  <Valdis.Kletnieks@...edu> wrote:
> On Tue, 30 Dec 2008 16:19:31 PST, chort said:
>
>> The viability of that approach depends on how much the code depends on
>> the systems being clustered together over low-latency interconnects.
>> 4000 machines spread all across the internet separated by 300ms of
>> latency is not the same thing as 4000 machines in the same room
>> running a cluster OS.
>
> They give a hint that it's *highly* parallel code:
>
> "This part is not suited for the PS3s SPU cores due to the large memory demands
> and the high number of branches in the software execution flow."
>
> Presumably, if the hit that a lot of branches create is bad, the *huge*
> hit of even an Infiniband interconnect would be fatal...
>

Ah, you're nit-picking on the fact that I mistakenly mentioned the
actual collision rather than the birthday attack, so yes my bad for
being careless with my terminology.

The more time-consuming part of the computation was the birthday
attack, which is what the PS3s _are_ good at.  You're right that the
collision blocks worked better on machines with more RAM and
instruction sets/pipelines designed for more branching.

In any case, we don't disagree that it's possible to conduct the
attack with a moderate-sized botnet.  We also agree that nutd0rk has
no idea what he's talking about (not that he ever does), so this
discussion seems to be heading no where.

-- 
chort

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/