[117077] in Cypherpunks
Re: PGP source and binaries comparisons, and vain and degrading
daemon@ATHENA.MIT.EDU (Steve Bryan)
Thu Aug 26 01:44:44 1999
Mime-Version: 1.0
Message-Id: <v04210100b3ea7d462001@[204.1.2.2]>
In-Reply-To: <v04205506b3ea2f32512b@[216.112.5.39]>
Date: Thu, 26 Aug 1999 00:28:44 -0500
To: Petro <petro@suba.com>
From: Steve Bryan <sbryan@vendorsystems.com>
Cc: cypherpunks@cyberpass.net
Content-Type: multipart/signed;
boundary="-=-=---===-====-=-==-==------=-=--=-=======--=-=";
protocol="application/pgp-signature"; micalg=pgp-sha1
Reply-To: Steve Bryan <sbryan@vendorsystems.com>
---=-=---===-====-=-==-==------=-=--=-=======--=-=
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii" ; format="flowed"
> His point, you Boob, is that any one of the constraints he
>mentions can change the binary enough to be different.
>
> Smart compilers can optimize code for a specific processor
>(3/4/5/686), as well there are a host of different optimizations one
>can ask of the compiler, and a bunch of link time stuff as well--if
>the libraries you are linking to are slightly different--caused by
>the same things in compiling them--and you are statically linking
>the binaries, you will get different results.
>
> There is also a difference between compilers, and versions of
>compilers--gcc 2.7.2, 2.8.1, egcs 1.1.2 and gcc 2.95 will all output
>different object code GIVEN EXACTLY THE SAME INPUT.
>
> This makes verifying the binaries a SERIOUSLY non-trivial
>task, and makes comparing them utterly useless without going thru
>them byte by byte, and then you STILL may miss a clever compromise.
>
>
> For fucks sake man, at least have a CLUE before you put your
>foot in your mouth.
No, verifying the binaries is NOT a SERIOUSLY non-trivial task. Yes,
there are a lot of compiler switches that allow you to produce
significantly varying versions but it is quite easy (at least with
Metrowerks) to set the switch for the freeware version and verify the
binary modulo the two slight byte ranges that I explained in another
message. Assuming you have the disk space, the development system,
and the additional libraries used (available via the net in each
case) you can be verifying in a day or less. As a bonus you can build
every other version if you care to. You also have some interesting
example source code for your platform and the platform independent
crypto source code to study. I would certainly highly recommend the
activity to any students. In the past there was a motto that
cypherpunks write code. I hope they are at least willing to attempt
to verify code without objecting preemptively that it is a hopeless
task.
Steve Bryan
email: sbryan@vendorsystems.com
icq: 5263678
pgp: D758 183C 8B79 B28E 6D4C 2653 E476 82E6 DA7C 9AC5
---=-=---===-====-=-==-==------=-=--=-=======--=-=
Content-Type: application/pgp-signature
-----BEGIN PGP MESSAGE-----
Version: PGPfreeware 6.5.1 for non-commercial use <http://www.pgp.com>
iQA/AwUBN8TQmOR2gubafJrFEQI3jQCg53Uq6QGowMzCowPqUgMPbn1S+akAoKWp
d5CRsoaccEPNr33IJvn5KH6K
=6AZN
-----END PGP MESSAGE-----
---=-=---===-====-=-==-==------=-=--=-=======--=-=--
