Full Disclosure mailing list archives
Re: windows linux final study
From: Valdis.Kletnieks () vt edu
Date: Thu, 07 Apr 2005 14:18:57 -0400
On Thu, 07 Apr 2005 11:23:31 CDT, Adam Jones said:
If your read the full message that you were replying to you would see that he addressed this issue in his reply. Vested interest and the parties responsible for funding research have no consequence if: 1) The methods employed are fully documented. 2) The results are fully reproducable. 3) The methods are acceptable as an unbiased appraisal of the situation.
Of course, in the real world, the important question is "How subtle were they in slanting the question in order to get the answer they wanted?".
To answer your (probably rhetorical) question: yes, I would trust the results of smartcard research by the manufacturer if they can prove the above three points to my satisfaction.
The problem is that it's often hard to directly map from "Is the research valid?" (i.e. fulfilling your 3 points above) to "Is this research actually applicable?". If the smartcard vendor runs a test that "proves card XYZ is invulnerable to attacks A, B, and C", that probably means that it's suitable for use in environments that only have those 3 attacks. If, however, your environment also needs to survive attack D, and the test was designed to not assess the strength against D because the vendor knew their card sucked at stopping attack D, you may be dissapointed.... Remember - *most* of the sponsored research is "valid". However, most also has been tweaked in the problem definition in order to slant the results - and the challenge is determining if the tweaked definition is still applicable.
Attachment:
_bin
Description:
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Re: windows linux final study Michael Simpson (Apr 06)
- Re: windows linux final study Adam Jones (Apr 07)
- Re: windows linux final study Valdis . Kletnieks (Apr 07)
- Re: windows linux final study Adam Jones (Apr 07)