Re: Announce loop-AES-v3.0b file/swap crypto package

[Paul Wayper <paul.wayper@xxxxxxxxxx>]

jerome etienne wrote:

> Jari Ruusu wrote:
>
> > jerome etienne wrote:
> >
> > > 3 years ago i published a paper describing how an attacker would be 
> > > able
> > > to modify the content of the encrypted device without being detected.
> > > http://off.net/~jme/loopdev_vul.html
> > >
> > > i was just curious about the current state of loop-aes. Is it still
> > > vulnerable to this attack ?
>
> so loopaes is still vulnerable to this 3-years old attack... but one 
> minute before answering my email, you complained to somebody else that 
> "Refusing to fix it for *years* counts as intentional backdoor."
> funny no :)

The one who isn't funny is you.  This is all very tedious, meaningless 
pointscoring on an issue which is, actually, not very interesting to 
(I'd say) a lot of us on the list.  I'm not partisan in this, I've just 
had to put up with you and Fruhwirth stirring up trouble for a couple of 
days and I'd like you to stop.

Though I'm not an expert on the code nor have I read through all the 
previous arguments, I'd say that your '3-year old attack' is not an 
attack on the loop-AES package nor something that patching it can fix.  
Otherwise, presumably, you'd have submitted a fix for it like a good 
Open Source Citizen.  Since you don't seem to have done this, I can only 
assume you're just stirring up trouble.  It sounds to me like your 
attack would work equally well on other crypto packages that don't guard 
the kernel and its tools from intruders.

I'm not interested in replies, since I don't want to waste any more time 
listening to this kind of one-upmanship.

Paul

--
-- Paul Wayper at ANU - +61 2 6125 0643


-
Linux-crypto:  cryptography in and on the Linux system
Archive:       http://mail.nl.linux.org/linux-crypto/