Consider that SecureRandom is really a facade around multiple providers that can plug in varying implementations. :)
How about this one?
http://xkcd.com/221/
Java Puzzle: Square Root
11–20 of 61 posts
Re: Java Puzzle: Square Root
#12Re: Java Puzzle: Square Root
#13Someone should just modify the StackSort algorithm that was posted yesterday (made up by xkcd) to search for Square Root functions instead and run them. http://gkoberger.github.com/stacksort/
That won't work. The point here is that you don't have the number available.
Re: Java Puzzle: Square Root
#14Can someone explain what this is asking? I don't know java
There is a really big number you don't know. You should get the square root for it.
Re: Java Puzzle: Square Root
#15Use reflection to read n. Reflection lets you bypass |private|.
He specifically says you need to leave the security manager in place and you can't use setAccessbile() which you need to do with the default security manager.
Re: Java Puzzle: Square Root
#16Can someone explain what this is asking? I don't know java
There is a really big number you don't know. You should get the square root for it.
So why are people talking about vulnerabilities and 'timing attacks' then? and how are you supposed to get the square root of a number you dont know..
Re: Java Puzzle: Square Root
#17Earlier quoted context omitted.
There is a really big number you don't know. You should get the square root for it.
So why are people talking about vulnerabilities and 'timing attacks' then? and how are you supposed to get the square root of a number you dont know..
You don't need to use timing attacks or other vulnerabilities. Others have pointed out how to do it, use SPI and provide your own implementation. The xkcd post is probably the best hint ;)
Re: Java Puzzle: Square Root
#18Earlier quoted context omitted.
There is a really big number you don't know. You should get the square root for it.
So why are people talking about vulnerabilities and 'timing attacks' then? and how are you supposed to get the square root of a number you dont know..
From what I understand a timing attack on SecureRandom to find out which number it generated. But I might be wrong in which case I'm sure someone knowledgeable will give you a better answer:)
edit: Yeah… just ignore this and look at the other answers ;)
Re: Java Puzzle: Square Root
#19Earlier quoted context omitted.
There is a really big number you don't know. You should get the square root for it.
So why are people talking about vulnerabilities and 'timing attacks' then? and how are you supposed to get the square root of a number you dont know..
The private function divides the unknown square by another number you provide. It's possible that how long this division takes depends on just what the secret number is -- keeping track of this and carefully feeding it input might reveal the number. That's a timing attack. (This is something you really have to consider when designing cryptographic functions and other such hardcore stuff.)
I suspect that doing something with the random seed is more what the author had in mind, though.
Re: Java Puzzle: Square Root
#20Consider that SecureRandom is really a facade around multiple providers that can plug in varying implementations. :)
Heh, not knowing Java very well, I scoured the BigInteger docs for quirks and loopholes, then gave up and found your comment. I guess "java.security.SecureRandom" sounded too impregnably secure to be worth looking into.