Re: [Hampshire] OpenSSL in Debian is broken

Top Page

Reply to this message
Author: Nick Chalk
Date:  
To: hampshire
Subject: Re: [Hampshire] OpenSSL in Debian is broken
Hugo Mills <hugo@???> wrote:
> On Wed, May 14, 2008 at 11:02:58PM +0000, Nick
> Chalk wrote:
>> I'm no cryptanalyst - or mathematician - so
>> I'll try to dig up an archive of the
>> discussion.
> Could be interesting (or scary, or both).


I think this was the thread:
http://www.mail-archive.com/cryptography@metzdowd.com/msg05464.html

Steven Bellovin's reply is a good summary:
http://www.mail-archive.com/cryptography@metzdowd.com/msg05486.html

This one's good, too:
http://www.mail-archive.com/cryptography@metzdowd.com/msg05506.html

"> But how should they do it?

    Very carefully.


    Picking random numbers is far too important to
    be left to chance."



Another interesting thread on the same theme:
http://www.mail-archive.com/cryptography@metzdowd.com/msg05260.html

A thread discussing an analysis of Linux's RNG:
http://www.mail-archive.com/cryptography@metzdowd.com/msg05888.html
including a scary metric by the name of
min-entropy:
http://www.mail-archive.com/cryptography@metzdowd.com/msg05929.html

>> I have a vague recollection that part of
>> argument was about sequence repetition.
> That's covered by Chris's definition


You see? I said I'm not a mathematician. :-)

Nick.

--
Nick Chalk ................. once a Radio Designer
Confidence is failing to understand the problem.