SAN FRANCISCO - An afternoon at the movies helped inspire two grad students to embarrass one of the hottest companies on the Internet.
After Ian Goldberg saw Hackers on Sunday, he decided to head back to the UC-Berkeley campus, where he and fellow computer science graduate student David Wagner finished work on a program to crack the security code Netseape Communications Corp. uses to protect Internet credit card transactions.
"The movie put me in a really techno mood," said the 22-year-old Canadian-born graduate of Waterloo University. "I came back with David, and we finished off the program in about four hours."
When they published their code-breaking formula on the Internet Sunday evening, they sparked a flurry of media inquiries that have kept them busy answering questions, such as why they wanted to defeat the security features of the most popular program for browsing the World Wide Web.
"If we, a couple of grad students, could discover this with a little bit of work, the bad guys with more incentive could have found the same problem," said Wagner, a 21-year-old New Jersey native and graduate of Princeton University.
"The only way around this is to publish the software code for encryption so people can test it," Wagner said. "One of the amazing discoveries about cryptography is that by releasing the details of how you make the lock, you don't diminish its security, you actually enhance it."
Officials at Netscape, whose stock closed up Tuesday despite the news, promised to fix the security flaw within a week, and said they would submit the solution to at least limited outside scrutiny.
Once the problem is solved, Netscape security manager Jeff Treuhaft said, Netscape will consider how to ensure that its security software has no other weak links.
"We are considering publishing the security area of our software so it can be generally tested," Treuhaft said. "We want there to be more confidence in the security software than existed before this flaw came to light."
Wagner said the pair's extra-curricular caper had begun last week, when he and Goldberg began studying how Netscape created the security keys to encrypt credit card transactions. The process begins when Netscape's browsing software creates what are supposed to be numbers.
"One of the rules of thumb cryptographers follow is to make sure they have good random numbers," Wagner said.
But in reading a Netscape programming outline, Wagner became convinced the company was using a predictable set of circumstances to generate its "random" numbers, which would have the effect of undermining the entire encryption scheme.
Meanwhile, Goldberg was looking at the same weakness another way. He spent a couple of days using a debugging program to examine the portion of the Netscape software that creates random numbers.
Debugging software has the ability to "X-ray" normal programs, revealing flaws in the machine or source code that makes all programs work.
Although they don't release the source code, they can't avoid releasing the machine code," Goldberg said. "So you can read their program whether or not they release the source code."
He and Wagner finished their analysis and proved that Netscape used predictable facts - like the time of the transaction and the process ID unique to each version of Netscape to generate a string of 30 numbers that formed the basis of the encryption key.
Knowing how the key was generated enabled the students to run a program that calculated all the possible keys within a matter of moments. They published their findings and a copy of their debugging routine late Sunday night on the Internet.
Goldberg said the moral of the story was that companies should publish the source code for security programs.
"If they had published the source code, (the flaw) would have been discovered quickly," he said.