[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <55813993.3020307@reactos.org>
Date: Wed, 17 Jun 2015 11:10:43 +0200
From: Pierre Schweitzer <pierre@...ctos.org>
To: oss-security@...ts.openwall.com
Subject: Re: PostgreSQL - Predictable cancel key
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
OK, got it. Thanks for the extra details!
Cheers,
On 06/16/2015 01:04 PM, Michael Samuel wrote:
> Hi,
>
> On 16 June 2015 at 20:15, Pierre Schweitzer <pierre@...ctos.org>
> wrote:
>
>> Well, I've thought about it, but that's still one million seeds
>> and the cancel key you're looking for might have been generated
>> after several random() call. So, that means perhaps 10 millions
>> values to explore? (If we make the hypothesis that for a given
>> initialization, it will only draw 10 PRN)
>>
>
> This is CPU, maybe GPU territory. 2^15-2 * 10m =~ 2^38 work
> offline.
>
>
>> How relevant would still be your cancel key once you found it?
>
>
> In the postmaster mainloop:
>
> ConnCreate() RandomSalt() -- the md5Salt craziness in the original
> post BackendStartup() MyCancelKey = PostmasterRandom();
>
> No other calls to random(), srandom() that I can see, and the other
> calls to PostmasterRandom() are generating cancel keys for worker
> procs.
>
> So if you brute the md5Salt you have a pretty good chance of
> guessing something that was/is/will be a cancel key of another
> session.
>
> Regards, Michael
>
- --
Pierre Schweitzer <pierre@...ctos.org>
System & Network Administrator
Senior Kernel Developer
ReactOS Deutschland e.V.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
iQIcBAEBCAAGBQJVgTmTAAoJEHVFVWw9WFsLPvQP/2wSyLB66VHajEtw+VQ49SKX
PQgznRxQaALO37RMZl9iXt5vAWuvTaRaue8LgmXl9GBSc6FYhYwXNO/WLNyodHO9
p8TAORnpGLvC8ncFjvK5Ier+t1/Fql9JUgIRO3pxHQuN8f7VK57GzobQzscNZK9I
6+7rka8/0cajgD6v1Ug3tbzSxcXzUVBC2wKW+vrqq0+g5I4V3Pc8JcfHp9UW4cXG
eDLtMUas/V2L2X8FDJiqHr+Y3nxB/Ijc3uXrI7DScyjvzr4KcCTtEN8+XRuOe5IQ
Zko/bSao+z0ar7k+MJxWS8zrQlfhAXHMhoQlvJI5z8QHokf4Fx+qQcmbgj7yIwxE
yQmXjeuwK1j7Qdu6L23/lmomRf7Ol861hbfVE8OWppAbAh7nSc6zd5aIVC0+KVQ0
6XrbUJDqWH9v1uzu/y7jYVb8/h6W80CDhzKyAUYlGN2mif9rok3xc6fOK7zhizoY
fOmGhpaLK2hdSorTluQYjyC8BpjeN4u6rQS3tDYKLgcxkIMFKs86QBqQ6t7C/po4
eAyXZc54FkzAaPNKGNN3LWYS3BzneFCZHlb5TTRBm0icJec2HNjR9gyXQ7uSAbiL
mtPKZP3lAh7UmnPqu43bbqddGG4b80+5Ec9d6cnUccHcxUMoTdFCSWBpExWxYuCb
+s82K50ECPtZIBOqg64+
=f/5m
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
