Re: Proposed new pcap format

[Darren Reed <darrenr () reed wattle id au>]

In some email I received from Jefferson Ogata, sie wrote:
> Darren Reed wrote:
> > In some email I received from Michael Richardson, sie wrote:
> > >  Prooving what? that you aren't being lied to? By whom?
> > >  What is the thread model for this? What does having the kernel digital
> > > sign stuff gain you? Who would lie to you in such a way that they
> > > couldn't also have the kernel lie to you?
> >
> > It's not about lieing so much as data integrity within the
> > computer/application and being able to trust that to a very
> > high level.
>
> Darren,
>
> I'm still trying to understand an attack or failure scenario where
> having the kernel MD5 the packet is any more reliable than having
> userland do it. Can you describe such a scenario?

I have less faith in a multithreaded program not stamping on data
between it being read from the kernel and md5'ing it.

Darren

-
This is the tcpdump-workers list.
Visit https://lists.sandelman.ca/ to unsubscribe.