[110302] in cryptography@c2.net mail archive
Re: Flaws in OpenSSL FIPS Object Module
daemon@ATHENA.MIT.EDU (Ed Gerck)
Sun Dec 9 19:14:22 2007
Date: Fri, 07 Dec 2007 10:15:50 -0800
From: Ed Gerck <edgerck@nma.com>
To: cryptography@metzdowd.com
In-Reply-To: <E1J0775-0002yC-Hk@wintermute01.cs.auckland.ac.nz>
Peter Gutmann wrote:
> While it's possible to say "There's something we noticed
> here in the source code that requires the software to be ejected from the
> train", it's a bit harder to say "We spent three months reverse-engineering
> someone else's proprietary protected intellectual property and think we may
> have found something".
Peter cites an important difference. You may be able to see but you can't tell.
However, one can still easily reverse-engineer to find the vulnerability
and then present an exploit saying "There's something we noticed here when
the code is executed with this input...".
The conclusion holds that closed-source is now less of a reasonable argument
in terms of /protecting/ source code.
Software-as-a-Service (SaaS), though, would still work in terms of
protecting source code, though, as all you have is a "service oracle" that
does not necessarily reveal code details or flaws. SaaS could be supplied
remotely or locally, with a secure processor card or secure USB-processor.
Cheers,
Ed Gerck
---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo@metzdowd.com
