Windows RNG Mayhem
Tue, 13 Nov 2007 11:01
An interesting paper -http://eprint.iacr.org/2007/419.pdf- was released 11/4/07 by some very sharp Israel based security researchers. The basic jist of this paper is that the random number generator in Windows 2K (and possibly other versions of Windows) is garbage. It's seeded poorly, runs in userland, and it appears that it's possible to not only gain access to future random values, but also all previous random values.
This has huge ramifications to things like SSL. Not only can you essentially crack SSL very rapidly, but it's also possible to historically crack captured conversations as well. A high level discussion of some of the issues can be found at:
http://www.eurekalert.org/pub_releases/2007-11/uoh-slf111207.php
Home | Tags: crypto, infosec | Category: /infosec | [0 comments] | Link


