Re: More on garbage

From: Anne & Lynn Wheeler <lynn@garlic.com>
Date: Sun Jun 12 2005 - 00:09:11 CEST

"Jon A. Solworth" <solworth@cs.uic.edu> writes:
> On the contrary, there is a difference between security and reliability.
> Security has an intelligent adversary where as reliability deals with
> independent random events.

warning topic drift .... one common(?) security abstraction is PAIN:

P ... privacy
A ... authentication
I ... integrity
N ... non-repudiation

it is sometimes CAIN ... confidentiality in place of privacy ... and
sometimes A is "availability" (although availability can be subsumed
under integrity). Also some people might sometimes refer to the "I" as
identification (but that gets into the subject that sometimes
authentication and identification are frequently confused).

In any case, ... reliability can be considered both an aspect of
overall integrity as well as an aspect of availability ... both
fundamental to the general security environment ... modulo frequent
efforts to treat security purely within the context of some sort of
(human) attack or exploit.

however, when we were starting the ha/cmp project
http://www.garlic.com/~lynn/subtopic.html#hacmp

one of the things we did was some detailed vulnerability analysis
... basically in support of RAS issues (reliability, availability,
serviceability).

one of the things we predicted was a dramatic increase in the
frequency of buffer length related vulnerabilities compared to other
environments that we were familiar with that used explicit lengths in
their abstracts (possible disclaimer at this point ... taking the side
of buffer length related exploits might be construed as support for
the predictions made nearly 20 years ago). at the RAS level ... it
didn't make any difference whether failures were purely random and
accidental or attacker induced.

in any case ... if the 911 service didn't work ... people might
questions its integrity ... regardless of whether of the causes of any
failures ... whether they were of purely naturally occuring random
events or direct human-based attacks.

lots of past buffer length related posts
http://www.garlic.com/~lynn/subpubkey.html#overflow

-- 
Anne & Lynn Wheeler | http://www.garlic.com/~lynn/

Received on Thu Sep 29 21:43:13 2005

sci.crypt archive

Re: More on garbage