Messages in this thread | | | Subject | Re: Linux 2.2.x ISN Vulnerability | Date | Sun, 26 Sep 1999 19:37:21 +0100 (BST) | From | Alan Cox <> |
| |
> I agree, using known data (port numbers, addresses) as "secret" data to > hash is false. Instead a good PRNG should be used everytime a sequence > number is needed, independent to any TCP data. Operating systems such as > OpenBSD do have cryptographical safe Sequence number generators, why > should Linux go the unsafe way ?
You can't just use a random number generator. There are _strict_ rules about sequence spaces keeping ordering. Otherwise your risk data corruption.
> old protocol suites. TCP Sequence numbers were never meant to be secure, a > 32 bit number just cannot guarantee security at all. Later when the first > spoofing vulnerabilities were discovered the reasons of the sequence > number shifted from a "to order data" meaning to a "guarantee security" > meaning.
Correct. You should be using encrypted IP. Unfortunately the US government still puts its paranoia before its people's safety
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
| |