Re: Working exploit for Debian generated SSH Keys

["Garrett M. Groff" <groffg () gmgdesign com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

I think the "wheel" in this context refers to exploit code, not PRNG code.

Generating pseudo-random numbers isn't hard given a good API, but writing
that API is non-trivial (assuming you want high entropy/low
predictability). And, apparently, screwing up that API is also very easy.

- - G



- ----- Original Message ----- 
From: "Skratz0r" <roryflyguy () googlemail com>
To: "nicolas vigier" <boklm () mars-attacks org>
Cc: <full-disclosure () lists grok org uk>
Sent: Monday, May 19, 2008 7:50 AM
Subject: Re: [Full-disclosure] Working exploit for Debian generated SSH
Keys


> > _>
>
> #1: It cant be that hard to generate random numbers.
> #2: It's hardly the wheel.
> #3: Again, pointless arguments.
>
> On 19 May 2008, at 12:09, nicolas vigier wrote:
>
> > On Mon, 19 May 2008, Ronald van der Westen wrote:
> >
> > > Why reinvent the wheel?
> >
> > Why not ?
> >
> > _______________________________________________
> > Full-Disclosure - We believe in it.
> > Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> > Hosted and sponsored by Secunia - http://secunia.com/
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/

-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.6.2 (Build 2014) - not licensed for commercial use: 
www.pgp.com

wj8DBQFIMb4YSGIRT5oVahwRAuQXAJ9UkoJplYiA6DiVbeRTbkwTDoovZQCeN7ir
t3YvNW8PRxJh3Fb4VrZ1ZDo=
=+k/9
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/