[45607] in Cypherpunks
Re: Java and timing info - second attempt
daemon@ATHENA.MIT.EDU (Bill Frantz)
Tue Dec 19 02:42:21 1995
Date: Mon, 18 Dec 1995 23:27:23 -0800
To: Jeff Weinstein <jsw@netscape.com>, Jim_Miller@bilbo.suite.com
From: frantz@netcom.com (Bill Frantz)
Cc: cypherpunks@toad.com
At 22:31 12/18/95 -0800, Jeff Weinstein wrote:
> In Netscape Navigator 2.0 Java and JavaScript do not have access
>to crypto routines. At some point in the future this will probably
>change, but only after we understand the implications much better
>than we do today.
More importantly for covert channel analysis, do they have access to good
clocks? Access to a good clock could make a Java applet a good candidate
for the receiver in a generalized covert channel attack. Access to both
process time and real-world time can give a good indication of load on the
processor, and might be needed for animation. A transmitter could send by
using or not using the CPU. (Installing the transmitter is left as an
excersize for the student. ;-) )
Who said that life was safe?
-----------------------------------------------------------------
Bill Frantz Periwinkle -- Computer Consulting
(408)356-8506 16345 Englewood Ave.
frantz@netcom.com Los Gatos, CA 95032, USA
