Re: My my, how time flies ...... it's been about "1 hour" -- anyone cracked CryptoSMS yet?

Mark Nudelman wrote:
> On 8/31/2005 11:02 AM, "- Prof. Jonez©" wrote:
> > Mark Nudelman wrote:
> >
> > > On 8/27/2005 9:07 PM, Crypto@S.M.S wrote:
> > >
> > > > CryptoSMS runs these test vectors (and many, many more) every
> > > > time
> > > > it initialises itself. If it fails its own self-test, it will
> > > > immediately announce that fact, because the user needs to know
> > > > their executable is corrupted. These test vectors are used
> > > > primarily to confirm a correctly running executable, not to
> > > > satisfy critics. CryptoSMS users need to be confident that the
> > > > instance
> > > > they are running at that moment passes all known tests.
> > >
> > > Surely you don't consider this to be an adequate test to determine
> > > whether the executable has been deliberately modified?
> >
> >
> > Why?
>
> For the reason I mentioned in my next sentence.
>
>
> > > If someone
> > > decides to patch an executable to modify its crytographic
> > > functionality, they can just as easily patch out the self-tests,
> > > or modify the code to report success without actually running the
> > > tests.
> >
> >
> > Why?
>
> I don't understand what you mean by this "Why?", so let me rephrase my
> point. Let's say that A somehow obtains permission to write to B's
> copy of the CryptoSMS executable. So he patches some of the
> cryptographic functions to weaken them in some way. But you claim
> he's foiled because when B runs the executable, it will run some code
> at startup that checks itself and detects that its crypto functions
> have been modified. But A is more clever than that -- he also
> patches this startup code to simply skip the checks and report that
> everything is fine. Now when B runs his binary, it reports that it
> passed its self tests, even though it is running modified crypto
> code. So there's no real point in running the self-test; it will
> stop only the stupidest attackers.

So then why would any system/programmer include self-testing?

>
> --Mark

"The most important thing is for us to find Osama bin Laden. It is our
number one priority and we will not rest until we find him."
          ~ George aWol Bush . 2001-Sept

"I don't know where he (bin Laden) is. I have no idea and I really don't care.
It's not that important. It's not our priority."
           ~ George aWol Bush 2002-March

"Gosh, I just don't think I ever said I'm not worried about Osama bin Laden.
It's kind of one of those ex-a-gger-a-tions."
               ~ George aWol Bush 2004 presidential debate
Received on Thu Sep 29 21:52:26 2005