Microsoft Responds to Secure Boot Story, Doesn't Address Issue
Linked by Thom Holwerda on Fri 23rd Sep 2011 22:22 UTC, submitted by kragil
Windows The story about how secure boot for Windows 8, part of UEFI, will hinder the use of non-signed binaries and operating systems, like Linux, has registered at Redmond as well. The company posted about it on the Building Windows 8 blog - but didn't take any of the worries away. In fact, Red Hat's Matthew Garrett, who originally broke this story, has some more information - worst of which is that Red Hat has received confirmation from hardware vendors that some of them will not allow you to disable secure boot.
E-mail Print r 6   · Read More · 187 Comment(s) http://osne.ws/jfl
Permalink for comment 490835
To read all comments associated with this story, please click here.
RE[6]: RSA key example.
by Alfman on Mon 26th Sep 2011 22:03 UTC in reply to "RE[5]: RSA key example."
Alfman
Member since:
2011-01-28

Neolander,

"I don't get how it is possible to create a hash function and publicly distribute it, in a way that mathematicians are not able to find collisions just by studying the form of the hash function itself."

This has to do with "diffusion".

It is actually rather easy to correlate bits for a single SHA1/2 round, such that one can derive the internal state of the hash function from the output bits. Hash/crypto functions are routinely cracked for a limited number of rounds.

But when the process is repeated a sufficient number of rounds, there is no record of which round(s) are responsible for changing a bit. All traces of the original bits are diffused and all that remains is unintelligible entropy. Algebraic solutions become exponentially complex and offer no benefit over brute force scanning. (As always, we're assuming the hash has no mathematically exploitable weaknesses).


This may be similar (or not) to dropping a pebble in a pool and then backtracking the point at which the pebble was dropped by observing the waves. As the waves bounce against the edge of the water, they become more and more diffused until one can no longer determine the point of origin.



"Well, I have a course on it later this school year (jan-feb 2012), so I can send you lecture notes if you want."

I'm curious at a high level, but I don't really feel like reading long papers. Whereas I used to buy computer books and read them through and through, today I can hardly bother to open the cover. I can't explain it, maybe it's the influence of the real world after college. I learned all this cool & interesting theory, but haven't much chance to really apply it in my jobs, and no ROI.

"It's targeted towards physicists...the mathematical part looking over-explained while the physical part would look under-explained."

I'd still need to learn the mathematics anyways.

Edited 2011-09-26 22:20 UTC

Reply Parent Score: 2