From:
Spence, Rohan
To:
Sekhon, Jiv
Subject:
FW: Some further information concerning use of the AWS in eVACS
Date:
Monday, 8 July 2024 9:01:53 AM
OFFICIAL
For your info
Ro Spence | Deputy Electoral Commissioner
ACT Electoral Commission
Phone: 02 6205 0224 | Mobile:
| www.elections.act.gov.au | facebook | twitter | youtube
Level 1, Nara Centre, 3 Constitution Avenue, Civic ACT 2601
From: Clive Boughton
Sent: Saturday, July 6, 2024 9:51 AM
To: Michael Chen
; Ji Zhang
; Carol
Boughton
Russell Baird
Spence, Rohan
; Cantwell, Damian
>
Subject: Fwd: Some further information concerning use of the AWS in eVACS
Caution: This email originated from outside of the ACT Government. Do not click links
or open attachments unless you recognise the sender and know the content is safe.
All,
Some pretty good news from AdaCore concerning both the AWS and CSPRNG issues picked up
by the anti-eVACS crowd.
I had put 5 QUESTIONS to Frederic Leger at AdaCore and his responses are shown in the email
below.
Regards.
Clive.
Dr Clive Boughton
Software Improvements
BYWONG NSW
Begin forwarded message:
From: Frederic Leger <
Date: 6 July 2024 at 00:19:43 AEST
To: Clive Boughton <c
>, product-
xxxxxxxx@xxxxxxx.xxx
Subject: Re: Some further information concerning use of the AWS in eVACS
Hello Clive,
we are actively working on it, and here are the information I gathered so far:
On Fri, Jul 5, 2024 at 3:10 AM Clive Boughton
>
wrote:
QUESTION 1: Will the fix(es) being made to AWS apply to servers as well as
clients?
The fix is already on GitHub. Only the client side must be updated to be safe against
that vulnerability.
QUESTION 2: Will I be able to simply swap out the old for the new modules in
my current system and recompile - rather than doing a complete version
update?
For AWS client, the AWS source needs an update. More modifications may come
from the CSPRNG update.
QUESTION 3: What strategy is AdaCore likely to take on treating the issue of
providing a CSPRNG capability?
We plan to implement a CSPRNG based on the OS capabilities
QUESTION 4: Again, if AdaCore does produce a decent CSPRNG, will it be
available as a replacement/addition that can simply be included in our existing
system?
The CSPRNG fix can be done in a way that would only require switching out one Ada
unit. We are willing to provide a CSPRNG in source form that will not need a full
update of GNAT.
QUESTION 5: Do you intend to seek further input from the disclosure parties on
current CSPRNG availability?
As it is a critical code, we will investigate using the various OS capabilities already
used by safe implementations.
Apologies for all these questions (and the way they've been worded), but we do
need to determine what we need to undertake (especially in terms of changes) in
order to deliver eVACS for this upcoming election.
Of course, there is the possibility that we may not be able to implement any/all
the necessary changes. The latter will probably mean dealing with media God
forbid!
No need to apologize, we fully understand, and are willing to help as quickly as
possible.
Thanks, and best regards.
