Strip Password Generator Limited Password-Space Vulnerability

Strip is a password generation utility made freely available by Zetetic Enterprises. Strip is a PalmOS based application designed to generate and store important passwords.

A problem with Strip makes it possible for a user that has attained an encrypted password generated with Strip to easily guess the password. The pseudo-random number generation is done through the SysRandom() syscall of PalmOS, which offers simplistic number generation. Additionally, the PNRG is seeded with number that may be small depending on the operation time of the Palm device. Finally, the maximum size of the seed is 16 bits.

Therefore, it is possible for a user to easily guess passwords generated with Strip, which have a maximum of 2^16 possibilities.


Privacy Statement
Copyright 2010, SecurityFocus