Windows XP, Microsoft Corp.’s most popular operating system, sports the same encryption flaws that Israeli researchers recently disclosed in Windows 2000, the Microsoft officials confirmed late Tuesday.
The researchers, Benny Pinkas from the University of Haifa and two Hebrew University graduate students, Zvi Gutterman and Leo Dorrendorf, reverse-engineered the algorithm used by Windows 2000’s pseudo-random number generator (PRNG), then used that knowledge to pick apart the operating system’s encryption. Attackers could exploit a weakness in the PRNG, said Pinkas and his colleagues, to predict encryption keys that would be created in the future as well as reveal the keys that had been generated in the past.
As recently as last Friday, Microsoft hedged in answering questions about whether XP and Vista could be attacked in the same way, saying only that later versions of Windows “contain various changes and enhancements to the random number generator.” Yesterday, however, Microsoft responded to further questions and acknowledged that Windows XP is vulnerable to the complex attack that Pinkas, Gutterman and Dorrendorf laid out in their paper, which was published earlier this month.
Windows XP, Vulnerability, Exploit, Microsoft