Bugtraq mailing list archives
Re: Jetty Session ID Prediction
From: Michal Zalewski <lcamtuf () dione ids pl>
Date: Tue, 6 Feb 2007 19:10:49 +0100 (CET)
On Tue, 6 Feb 2007, Chris Anley wrote:
http://www.ngssoftware.com/research/papers/Randomness.pdf
Nice paper, and quite certainly helpful for security testers as far as showing the weakness of standard library PRNGs to others goes.
The idea is eventually to have a tool that performs point-and-click identification, analysis and prediction of an unknown source of "randomness", including LCGs but also more advanced generators such as the Mersenne twister and SHA1PRNG.
Now not that I want to be obtrusive than I already am (hi mom!), but http://lcamtuf.coredump.cx/stompy.tgz can very well tell LCGs from SHA1PRNGs - that and do a bunch of other tricks ;-) /mz
Current thread:
- Jetty Session ID Prediction NGSSoftware Insight Security Research (Feb 05)
- Re: Jetty Session ID Prediction Amit Klein (Feb 05)
- Re: Jetty Session ID Prediction Michal Zalewski (Feb 05)
- Re: Jetty Session ID Prediction Amit Klein (Feb 06)
- Re: Jetty Session ID Prediction Michal Zalewski (Feb 06)
- Re: Jetty Session ID Prediction Amit Klein (Feb 06)
- <Possible follow-ups>
- Re: Jetty Session ID Prediction Chris Anley (Feb 06)
- Re: Jetty Session ID Prediction Amit Klein (Feb 06)
- Re: Jetty Session ID Prediction Chris Anley (Feb 07)
- Re: Jetty Session ID Prediction Michal Zalewski (Feb 06)
- Re: Jetty Session ID Prediction Amit Klein (Feb 06)