News for hackers. Stuff that matters.

A comment on A public TrueCrypt Audit. Parent comment

Re:A public TrueCrypt Audit by munin on Wednesday October 09, 2013 @03:36PM (#6523328)
in theory, it doesn't need to be. you could formalize the definition of the TrueCrypt cryptographic protocol in cryptol[1] and then have a checker run as part of unit tests that verifies the source code is still a faithful implementation of the protocol...

1: http://corp.galois.com/cryptol/

[ Parent | on HN ]
Re:A public TrueCrypt Audit by yeukhon on Wednesday October 09, 2013 @03:44PM (#6523373)
I am not familiar with this, but an implementation flaw or bug could be an intentional backdoor. Can we automate checking process? That probably requires humans to audit the source code.

How big is TrueCrypt and how many contributions does it get? Certainly Linux kernel is so big and gets so many patches a day that even changeset analysis can be hard.

[ Parent | on HN ]
Re:A public TrueCrypt Audit by 0x0 on Wednesday October 09, 2013 @06:33PM (#6524354)
Would that be able to detect even /accidental/ bugs like the ultra-weak Debian OpenSSL random number generator?
[ Parent | on HN ]