Example: Encrypted session (based on deployed code)

/* establish key */

MySecret = randval();

MyPublic= DHpub(MySecret);

send_val(MyPublic);

HisPublic = recv_val();

key = DHcalc(MySecret, HisPublic);

DESsetkey(key);

/* run session */

...

• This is just the standard way to do Diffie-Hellman

• All the lib functions were implemented correctly

  • even randval()

• But DESsetkey() wanted the 8 parity bits set in key

  • otherwise returned an error and no session key was set

• Result: 255/256 sessions used a null key!

Previous slide

Next slide

Back to first slide

View graphic version