On Mon, 17 Sep 2007 15:50:33 +0200 (CEST) Wojciech Puchar <[EMAIL PROTECTED]> wrote:
> > same Yarrow pseudo-random sequence. If enough of the random data > > survives at the end of the dvd it may allow an attack against the > > PRNG. > > > > As things stand, Yarrow is secure, but it might not be a few years > > from now. > > > always humans make most of security problems, not programs. Yes, indeed. This, and poor key management techniques... > if you need more security simply modify random generation code. even > if it will be worse after your modification, it will be unique, and > unknown to attackers. and that's the best protection Just because it is unknown to attackers doesn't mean that it is more secure. You can inadvertently produce *less* entropy and randomness without even noticing it, and cryptanalysts are *very* good at identifying this with statistical and other mathematical methods, even without knowing the algorithm used to generate the random stream. Security through obscurity (even for algorithms generating random sequences) isn't the way to go if you're really security-aware. -- Cordula's Web. http://www.cordula.ws/ _______________________________________________ firstname.lastname@example.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "[EMAIL PROTECTED]"