Re: [gnukeyring-discuss] development

[Florin A. <fl...@sg...>]

On Thu, 2003-10-23 at 10:58, Jochen Hoenicke wrote:

> No, the development hasn't stopped.  I'm preparing a new version with
> a new crypto algorithms and it takes some time, especially as I can only
> work on weekends.  I hope to have a test release, soon.

Awesome!

Jochen, can i ask a few "hard" questions?
What's the actual strength of the encryption algorithms on a device
running PalmOS? Applications running on Unix clones make use of various
network- and system-events to feed some pseudo-random numbers
generators. Is there anything like that on PalmOS?
I guess what i'm asking is, are there any inherent weaknesses in an
application that runs on PalmOS and uses strong encryption, just because
it runs on PalmOS?

I'm quite aware that the encryption algo might not be the weakest link
in the chain, so perhaps there's no point in worrying too much about
that (*) but i thought i should ask anyway.

(*) - Much more important seems to be the master password on the Keyring
application. If that's too weak, the database is easily crackable.
Also, a resourceful group might read micro-scratches on the Grafitti
area and deduce often-used string patterns.
Finally, if the application "leaks" information into the palmtop's
memory, that could be used as well to do some guessing.

In any case, a palmtop is never to be considered totally secure, but i
feel that, if the encryption stuff doesn't have any inherent flaws, the
security of the hardware should be better than that of the PCs (it's a
lot harder to install "keystroke loggers", it's a lot harder to snoop on
the RF fields generated by the display and by the input device, etc.).

> There will also be a minor bug fix release 1.2.3 (dirty flag isn't set on
> changed records), but that has no new features.

An upgrade from 1.1 should be straightforward, right?

-- 
Florin Andrei

http://florin.myip.org/