CVS update: samba/source

Andrew Tridgell tridge at samba.anu.edu.au
Tue Apr 21 16:50:14 EST 1998


> PLEASE REVIEW THIS CODE AND SUGGEST IMPROVEMENTS !!!!!!

Hmmm, there is a more fundamental flaw. It returns a 32 bit int, and
the generation of the new machine password is deterministically based
on this result.

That means with a 9GB disk you could easily hold a complete lookup
table of all possible passwords. Not very good ...

The bottleneck is calling srandom() with a 32 bit secret key then
getting everything from ramdom(). Maybe we should instead keep the
nice 128 bit result from md4 in do_reseed() and use that to generate
the random buffer? Calling md4 on it's own output will be a reasonable
way of generating each block in turn.

Cheers, Andrew


More information about the samba-cvs mailing list