🚀 go-pugleaf

In article <581@gec-mi-at.co.uk> adam@gec-mi-at.co.uk (Adam Quantrill) writes:
>So,
>for a less secure method, I propose to generate the random string by exclusive-
>oring any combination of n text and binary files held on computer:
>
>e.g. exor /bin/sh /bin/crypt /etc/termcap | exor my_text

This method is quite similar to using a common book (dictionary, bible,
romance novel) as a source of code strings.  The security depends on the
secrecy of the algorithm for generation of the code strings and secrecy of
the selection of source material. The source material itself isn't secret at
all, and divulging the algorithm (as you just did) makes the system highly
insecure.  The choice of source material is also vulnerable to attack if the
choice can be inferred from knowlege of the parties involved (e.g. rabid
UNIX freaks, working on Suns) - best to use something more obscure.

-- 
Craig Hansen
Manager, Architecture Development
MIPS Computer Systems, Inc.
...decwrl!mips!hansen