News for hackers. Stuff that matters.

A comment on Schneier's take on the alleged backdoor in OpenBSD. Parent comment

Re:Schneier's take on the alleged backdoor in OpenBSD by tptacek on Friday December 17, 2010 @07:10PM (#2018408)
In the early 2000's I was still speaking to Theo, and I don't believe that during that time period he ever did systemic fuzz testing on OpenBSD. SPIKE wasn't even released until 2002.

Also: while we use fuzzers to probe for specific kinds of crypto flaws, the kind of fuzzing being done then (and for the most part today) does not identify crypto flaws.

We are, let's be clear, talking about a project that appears to have managed to ship IPSEC code that didn't verify packet authenticators for something like a year.

[ Parent | on HN ]
Re:Schneier's take on the alleged backdoor in OpenBSD by 16s on Friday December 17, 2010 @07:12PM (#2018415)
Here is what he said about his fuzz testing in 2000:

http://lwn.net/2000/0803/a/openbsdfuzz.php3

[ Parent | on HN ]
Re:Schneier's take on the alleged backdoor in OpenBSD by tptacek on Friday December 17, 2010 @07:16PM (#2018425)
He's talking about the academic research project fuzzing was named for. All it did was fuzz command line arguments.
[ Parent | on HN ]