[109955] in cryptography@c2.net mail archive
Re: Flaws in OpenSSL FIPS Object Module
daemon@ATHENA.MIT.EDU (Ralf-Philipp Weinmann)
Wed Dec 5 17:16:33 2007
Cc: "Perry E. Metzger" <perry@piermont.com>, cryptography@metzdowd.com
From: Ralf-Philipp Weinmann <weinmann@cdc.informatik.tu-darmstadt.de>
To: Paul Hoffman <paul.hoffman@vpnc.org>
In-Reply-To: <p06240804c379d62c6acd@[192.168.1.62]>
Date: Wed, 5 Dec 2007 12:43:21 +0100
X-MailScanner-From: weinmann@cdc.informatik.tu-darmstadt.de
--Apple-Mail-75--495530932
Content-Type: text/plain;
charset=US-ASCII;
format=flowed;
delsp=yes
Content-Transfer-Encoding: 7bit
On Dec 3, 2007, at 16:51 , Paul Hoffman wrote:
> At 9:58 AM -0500 12/3/07, Perry E. Metzger wrote:
>> I don't know if people have been following this, but it is
>> interesting
>> from the point of view of studying how the FIPS process does (or does
>> not) interact with the underlying goal of producing assured systems.
>
> Another interesting part is that open-source systems are much more
> susceptible to being attacked by competitors (that is, having their
> validation suspended) than are closed-source systems.
Hi Paul,
this may have been true in the past. Enter tools like BinDiff [1] and
BinNavi [2] and a skilled reverse engineer is able to shoot down
you're closed-source implementation almost as quickly as one for which
she has source (assuming she has binaries, of course).
Cheers,
Ralf
[1] Zynamics BinNavi
http://www.zynamics.com/index.php?page=binnavi
[2] Zynamics BinDiff
http://www.zynamics.com/index.php?page=bindiff
--Apple-Mail-75--495530932
Content-Disposition: attachment;
filename=smime.p7s
Content-Type: application/pkcs7-signature;
name=smime.p7s
Content-Transfer-Encoding: base64
MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIE1DCCBNAw
ggO4oAMCAQICAh+aMA0GCSqGSIb3DQEBBQUAME0xCzAJBgNVBAYTAkRFMRUwEwYDVQQKEwxUVSBE
YXJtc3RhZHQxFjAUBgNVBAsTDUZCIEluZm9ybWF0aWsxDzANBgNVBAMTBlJCRyBDQTAeFw0wNzEy
MDQxMjMwMzRaFw0wODEyMDIyMzAwMDBaMGoxCzAJBgNVBAYTAkRFMRUwEwYDVQQKEwxUVSBEYXJt
c3RhZHQxFjAUBgNVBAsTDUZCIEluZm9ybWF0aWsxDDAKBgNVBAsTA0NEQzEeMBwGA1UEAxMVUmFs
Zi1QaGlsaXBwIFdlaW5tYW5uMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCBPe+fhJxcbY26
ex/BA+HigGyemPdncbcB7E0+cyScLfafJR1VNNmPDBks/lzSuVCVxYz6wa2qGEWB6G3+EI+k6RJl
jd9DHNhM745x7ubPZHjLVFylbacAppPY2z8ilGxRnriRMF1CfysExvbY5DjFM/fL2aIMqWm7nc+D
74aqQwIDAQABo4ICHzCCAhswDgYDVR0PAQH/BAQDAgP4MBEGCWCGSAGG+EIBAQQEAwIEsDAhBglg
hkgBhvhCAQ0EFBYSUkJHIENBIGNlcnRpZmljYXRlMDIGA1UdEQQrMCmBJ3dlaW5tYW5uQGNkYy5p
bmZvcm1hdGlrLnR1LWRhcm1zdGFkdC5kZTBmBgNVHSAEXzBdMFsGCysGAQQBwG0BAQEDMEwwSgYI
KwYBBQUHAgEWPmh0dHBzOi8vY2VydC1yYS5yYmcuaW5mb3JtYXRpay50dS1kYXJtc3RhZHQuZGUv
cG9saWN5L2Nwcy5odG1sMIH2BgNVHR8Ege4wgeswgeiggeWggeKGgd9sZGFwOi8vY2VydC1yYS5y
YmcuaW5mb3JtYXRpay50dS1kYXJtc3RhZHQuZGU6L2NuPXJiZyUyMGNhLE9VPUZCJTIwSW5mb3Jt
YXRpayxPPVRVJTIwRGFybXN0YWR0LEM9REUsZGM9Y2VydC1yYSwlMjBkYz1yYmcsJTIwZGM9aW5m
b3JtYXRpayxkYz10dS1kYXJtc3RhZHQsZGM9REU/Y2VydGlmaWNhdGVSZXZvY2F0aW9uTGlzdD9i
YXNlP29iamVjdENsYXNzPWNSTERpc3RyaWJ1dGlvblBvaW50MB0GA1UdDgQWBBQmBt29LQd6EaT8
QZxIFmi6fyoc/zAfBgNVHSMEGDAWgBQL+Cu3tYjIA37rHBxVrhe0S7DHuzANBgkqhkiG9w0BAQUF
AAOCAQEArmVOImrw5HkeYesH7dRbmH06Q3x8VlOtufrjR9rg2K3wEXOtU0wRqFPlqzDcEVVTZAlg
Gb4fpZKuXZQ/b6r8GHmRDWQQlkbsZc/B/X8qcly+CSz4oC8FsWC/eNkktqOHolImX769zRTqVnSx
L3wgxv4rMubTAkvp8qYlc3emF3Q0rNEIR8AHMq79SElK/DR7lYe44Jjv1dXHwvqQ138w5Cmicq9H
mq+BHux12SWtDI+djdIHMk9sU5f1WgZuQk2yKBvNSI2y8bjwV5hqWulq3uFT253rSnCl9O1kHNp8
GlGP32aL0Ex7StLpMUQqREQNME8TqTVHSjc0+lwKHGHhkjGCAiQwggIgAgEBMFMwTTELMAkGA1UE
BhMCREUxFTATBgNVBAoTDFRVIERhcm1zdGFkdDEWMBQGA1UECxMNRkIgSW5mb3JtYXRpazEPMA0G
A1UEAxMGUkJHIENBAgIfmjAJBgUrDgMCGgUAoIIBJzAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcB
MBwGCSqGSIb3DQEJBTEPFw0wNzEyMDUxMTQzMjFaMCMGCSqGSIb3DQEJBDEWBBTEUKK81fmT0PZ6
jsPffoF7m7o3SjBiBgkrBgEEAYI3EAQxVTBTME0xCzAJBgNVBAYTAkRFMRUwEwYDVQQKEwxUVSBE
YXJtc3RhZHQxFjAUBgNVBAsTDUZCIEluZm9ybWF0aWsxDzANBgNVBAMTBlJCRyBDQQICH5owZAYL
KoZIhvcNAQkQAgsxVaBTME0xCzAJBgNVBAYTAkRFMRUwEwYDVQQKEwxUVSBEYXJtc3RhZHQxFjAU
BgNVBAsTDUZCIEluZm9ybWF0aWsxDzANBgNVBAMTBlJCRyBDQQICH5owDQYJKoZIhvcNAQEBBQAE
gYBl3tTaUGyOW+Cyr4h/35zjM37qBs2GhO9Sz8ZCypXvomDiW5+Pdec9BOwvWeGBnUNwKjYFViun
88lAMhXHGEBGm9FUGwjrMJQXuNtWIBLVZpY6waB8KHkyK+2q4cuuCMoJtKOatDEsMznOrJndaqdV
AB2JShn48d+xjwvBgZ7CLAAAAAAAAA==
--Apple-Mail-75--495530932--
---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo@metzdowd.com
