Re: [Full-disclosure] Creating a rogue CA certificate

[chort <chort0@xxxxxxxxx>]

On Tue, Dec 30, 2008 at 4:27 PM,  <Valdis.Kletnieks@xxxxxx> wrote:
> On Tue, 30 Dec 2008 16:19:31 PST, chort said:
>
>> The viability of that approach depends on how much the code depends on
>> the systems being clustered together over low-latency interconnects.
>> 4000 machines spread all across the internet separated by 300ms of
>> latency is not the same thing as 4000 machines in the same room
>> running a cluster OS.
>
> They give a hint that it's *highly* parallel code:
>
> "This part is not suited for the PS3s SPU cores due to the large memory 
> demands
> and the high number of branches in the software execution flow."
>
> Presumably, if the hit that a lot of branches create is bad, the *huge*
> hit of even an Infiniband interconnect would be fatal...
>

Ah, you're nit-picking on the fact that I mistakenly mentioned the
actual collision rather than the birthday attack, so yes my bad for
being careless with my terminology.

The more time-consuming part of the computation was the birthday
attack, which is what the PS3s _are_ good at.  You're right that the
collision blocks worked better on machines with more RAM and
instruction sets/pipelines designed for more branching.

In any case, we don't disagree that it's possible to conduct the
attack with a moderate-sized botnet.  We also agree that nutd0rk has
no idea what he's talking about (not that he ever does), so this
discussion seems to be heading no where.

-- 
chort

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/