OpenBSD Will Not Fix PRNG Weakness

snake-oil-security writes "Last fall Amit Klein found a serious weakness in the OpenBSD PRNG (pseudo-random number generator), which allows an attacker to predict the next DNS transaction ID. The same flavor of this PRNG is used in other places like the OpenBSD kernel network stack. Several other BSD operating systems copied the OpenBSD code for their own PRNG, so they're vulnerable too; Apple's Darwin-based Mac OS X and Mac OS X Server, and also NetBSD, FreeBSD, and DragonFlyBSD. All the above-mentioned vendors were contacted in November 2007. FreeBSD, NetBSD, and DragonFlyBSD committed a fix to their respective source code trees, Apple refused to provide any schedule for a fix, but OpenBSD decided not to fix it. OpenBSD's coordinator stated, in an email, that OpenBSD is completely uninterested in the problem and that the problem is completely irrelevant in the real world. This was highlighted recently when Amit Klein posted to the BugTraq list."

Comments

Re:Uh what

[fulldecent]

You cracked Marc's 128-bit encryption, but your Slashdot id is 263942. Doesn't add up.

Re:then exploit it (if you can)

[orgelspieler]

I wrote a program like that once. It kept on outputting 42.

Code excerpt for the curious...

[davidbrit2]

http://xkcd.com/221/ Oh hush, you knew somebody would post it.

Re:Uh what

[LizardKing]

That's because he's so l33t he can pick a Slashdot id at random every time he posts.

Re:then exploit it (if you can)

[Anonymous Coward]

So did I:

10 PRINT "42"
20 GOTO 10

Re:Uh what

[Anonymous Coward]

They used to give accounts to anyone...

...and their standards have declined over time :)

Re:Uh what

[jirka]

I would be more impressed if he did not have any slashdot login. Having even read this discussion decreases his credibility.