Path: utzoo!utgpu!watserv1!watmath!att!linac!uwm.edu!wuarchive!uunet!shelby!B.GP.CS.CMU.EDU!mdl
From: mdl@B.GP.CS.CMU.EDU (Mark Lillibridge)
Newsgroups: comp.protocols.kerberos
Subject: timestamp in authentication process
Message-ID: <9103011521.AA06182@shelby.Stanford.EDU>
Date: 1 Mar 91 15:19:19 GMT
References: <9103011115.aa02061@flits.cs.vu.nl>
Sender: news@shelby.stanford.edu (USENET News System)
Organization: Internet-USENET Gateway at Stanford University
Lines: 28


   Date: Fri, 01 Mar 91 11:15:13 +0100
   From: leendert@flits.cs.vu.nl


>   #        But...  where do you get the random numbers from?  There are no
>   #random numbers available on a public workstation before a user logs in.
>
>   In my case (Amoeba) that wouldn't be too hard. Every kernel has its own
>   random generator which is initialized with some hardware dependent values
> (clock, offset of the printbuf, etc). This mechanism should work equally well
>   for other systems, I suppose. I know these number aren't perfect, but it
>   all depends on the quality of your random generator and the seed.
>
>   Leendert


	The big problem here is that these numbers aren't random, only
pseudo-random which usually isn't good enough for security purposes.
Moreover, suppose you did this.  I walk up to a workstation, break in
(via physical means if necessary), and change the pseudo-random number
seed to a value of my choosing.  I then log out and walk away.  You then
walk up and sit down & log in.  You are now using non-random numbers (at
least from my perspective) and worse, depending on the seed I choose,
you may be reusing old numbers and hence be vulnerable to replay
attacks.

						- Mark