共38篇文章。
前几天 hzqbbc 兄 [blog]在blog上留言中提及此事，正好就这个话题说两句。
通常我们在设计安全系统的时候，会希望在满足功能的前提下为每个用户授予最少的权限。对一个数据元而言，假如我们限定允许的权限包含：写、读(获取其内容)、验证(判断给定值是否有很大概率与其相等)、判断其是否存在、完全没有这5类时，通常我们会发现，比较靠前的权限会包含(或暗含)靠后的权限，或者说，靠前的授权要比靠后的授权来的大。(注意，此处我们并不考虑拥有写权限，而没有读权限这种情形，这种授权通常见于文件系统)。
我们来看看那个人说的这段话：
I’d be really surprised if somebody is actually able to get a real-world attack on a real-world pgp key usage or similar out of it (and as to the covert channel, nobody cares). It’s a fairly interesting approach, but it’s certainly neither new nor HT-specific, or necessarily seem all that worrying in real life.(HT and modern CPU speeds just means that the covert channel is _faster_ than it has been before, since you can test the L1 at core speeds. I doubt it helps the key attack much, though, since faster in that case cuts both ways: the speed of testing the cache eviction may have gone up, but so has the speed of the operation you’re trying to follow, and you’d likely have a really hard time trying to catch things in real life).
It does show that if you want to hide key operations, you want to be careful. I don’t think HT is at fault per se.
一个神话的最终结束……
http://www.schneier.com/blog/archives/2005/02/sha1_broken.html
Researchers have announced preliminary indications of previously unknown vulnerabilities in popular security algorithms that could permit hackers to easily install undetectable back doors into computer code or to counterfeit electronic signatures. French computer scientist Antoine Joux reported on Aug. 12 his discovery of a flaw in the MD5 algorithm, which is often used with digital signatures. The algorithm is known as a hash function, which extrapolates from all input a unique fingerprint; however, if a hacker could produce the same fingerprint with a different input stream, then the resulting hash collision would authenticate software as safe to download and execute even though it contains a back door. MD5 is employed by the open-source Apache Web server product as well as Sun Microsystems’ Solaris Fingerprint Database, and the flaw Joux uncovered means that a hacker can produce one hash collision in a few hours on a standard PC. Meanwhile, four Chinese researchers issued a paper reporting that the SHA-0 Secure Hash Algorithm could be subverted, while Israel Institute of Technology researchers Eli Biham and Rafi Chen revealed at the Crypto 2000 conference on Aug. 17 that they were investigating possible flaws in the SHA-1 algorithm, the only signing algorithm approved for use in the U.S. Digital Signature Standard. SHA-1, which is incorporated into popular programs such as SSL and PGP, is thought to be secure because knowingly producing hash collisions via existing methods is impossible. SHA-1 depends on a computer executing a routine 80 times as it tries to create a unique fingerprint, and Biham declared that he was able to copy the fingerprint for 36 of those 80 executions. If SHA-1 shares similar vulnerabilities with SHA-0, then attempts to falsify a fingerprint would be sped up about 500-fold.
Yesterday someone has asked me about my diary system, I told her that my diary is managed by my own diary software, which is a close-source system (written in C#) and I do not want to share it with others because it is technically not a friendly one.
选择P2P作为毕业设计的题目应该不是一个偶然，可以说，这个想法从大二就在酝酿，到了四年级，终于得以实现，不能不说是一大快事。
说到P2P，古人说，挟天子以令诸侯，然而，我一直怀疑，一个连自己都罩不住的天子，明明都被人「挟」了，如何得以号令天下？如果说他能罩得住自己，那么，连他都能「挟」了的人为什么不自己称王呢？总之，我一直觉得，挟天子以令诸侯这类事儿属于子虚乌有，多半是文人墨客笔下的夸张吧。
Theo de Raddt has pointed out that the /dev/crypto testing program in FreeBSD, like in NetBSD, was derived from a test program which he never published with a free license. It has now been deleted from the NetBSD tree as well.