On Thu, May 15, 2008 at 11:51 PM, Erik de Castro Lopo <[EMAIL PROTECTED]> wrote: > Bodo Moeller wrote:
>> It may be zero, but it may be more, depending on what happened earlier >> in the program if the same memory locations have been in use before. >> This may very well include data that would be unpredictable to >> adversaries -- i.e., entropy; that's the point here. > Do you know its unpredicatable or are you only guessing? > > Can a bad guy force it to be predicatable? > > How much entropy is actually there? Has anyone actually measured it? All this depends on the specific application. For many, there almost certainly won't be any unpredictable data. For others, in particular long-running interactive software, there certainly will be at least some information that is unpredictable to at least some adversaries. Even if it's just return addresses on the stack, the specific pattern will depend on the program's past, some aspects of which may be unknown to adversaries. We don't care if anyone can force this to be predictable, because we're in no way relying on it to deliver more than zero bits of entropy. We're just hoping there might be some entropy in there sometimes. ______________________________________________________________________ OpenSSL Project http://www.openssl.org Development Mailing List openssl-dev@openssl.org Automated List Manager [EMAIL PROTECTED]
