Slashdot Mirror
Loophole in Windows Random Number Generator
Invisible Pink Unicorn writes "A security loophole in the pseudo-random number generator used by Windows was recently detailed in a paper presented by researchers at the University of Haifa. The team found a way to decipher how the number generator works, and thus compute previous and future encryption keys used by the computer, and eavesdrop on private communication. Their conclusion is that Microsoft needs to improve the way it encodes information. They recommend that Microsoft publish the code of their random number generators as well as of other elements of the Windows security system to enable computer security experts outside Microsoft to evaluate their effectiveness. Although they only checked Windows 2000, they assume that XP and Vista use similar random number generators and may also be vulnerable. The full text of the paper is available in PDF format."
Who are they? At least give us some names here.
A newly registered guy, even if they're named secPM_MS, doesn't buy much. It looks like you registered just to post on this story, in fact, though at least you seem to know something about the internals of Microsoft.
Also, even if these guys are competent cryptographers, shouldn't their work be peer-reviewed? If you really are a security PM, you should understand that in cryptography, secret methods are not trusted for good reason. After all, it's very easy to do something that's subtly wrong in cryptography that ruins otherwise great systems, so the more scrutiny a method has withstood, the more people trust it.