Re: Java and timing info - second attempt

[frantz@netcom.com (Bill Frantz)]

At 22:31 12/18/95 -0800, Jeff Weinstein wrote:
>  In Netscape Navigator 2.0 Java and JavaScript do not have access
>to crypto routines.  At some point in the future this will probably
>change, but only after we understand the implications much better
>than we do today.

More importantly for covert channel analysis, do they have access to good
clocks?  Access to a good clock could make a Java applet a good candidate
for the receiver in a generalized covert channel attack.  Access to both
process time and real-world time can give a good indication of load on the
processor, and might be needed for animation.  A transmitter could send by
using or not using the CPU.  (Installing the transmitter is left as an
excersize for the student. ;-) )

Who said that life was safe?


-----------------------------------------------------------------
Bill Frantz                   Periwinkle  --  Computer Consulting
(408)356-8506                 16345 Englewood Ave.
frantz@netcom.com             Los Gatos, CA 95032, USA