GNU bug report logs - #22202
24.5; SECURITY ISSUE -- Emacs Server vulnerable to random number generator attack on Windows systems

Previous Next

Full log

View this message in rfc822 format

From: Richard Copley <rcopley <at> gmail.com>
To: Eli Zaretskii <eliz <at> gnu.org>
Cc: 22202 <at> debbugs.gnu.org, Demetri Obenour <demetriobenour <at> gmail.com>, David Engster <deng <at> randomsample.de>
Subject: bug#22202: 24.5; SECURITY ISSUE -- Emacs Server vulnerable to random number generator attack on Windows systems
Date: Wed, 30 Dec 2015 21:15:13 +0000

> That'd be the worst of both worlds, IMO: a not-so-good PRNG with no
> way whatsoever to get a repeatable sequence.  Am I right?

Oh dear. Yes. Worse than that, repeatability is part of the contract for
the lisp "random" function, so seed_random() and get_random() are
constrained to be deterministic. Right?

Seems as though init_random() is the only place that could use
CryptGenRandom, which is a pity if you're trying to confine the
changes to w32.c.

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.