                             Valid8 1.00
                      A freeware implementation of
                    McAfee Associates VALIDATE 2.00

The validate program from McAfee Associates has changed recently, with
a new version being distributed with Scan 2.1.0e.  Source code by Gary
Musser which duplicated the effects of the original McAfee Validate
program is at oak.oakland.edu:/pub/msdos/virus/pvalidat.zip, but at
least to my knowledge as of 20 August 1994, no code was available which
is compatible with the new Validate 2.00.

It is useful to have the source code for a portable version available
because BBS sysops and others may want to verify the validate codes of
some software, but they may not be operating under MS-DOS, and so it may
not be convenient to run the McAfee Validate program.  But if they have
an ANSI C compiler for their system then they can compile either valid8.c
or pvalid8.c and have a validate program for their environment which is
completely compatible with the validate program from McAfee Associates.

The CRCs used by the original Validate program are not very secure,
and the new ones somewhat less so.  The original Validate used two
different 16-bit CRCs.  It has been shown that it is no harder to
forge two 16-bit CRCs than to forge one 32-bit CRC which is the least
common multiple of them.  I have always been told that the two CRC
generator polynomials used by Validate were proprietary, but while
doing research in preparation of writing Valid8 I discovered that
in fact they were using the polynomials used in the XMODEM protocol
and ARC archive files.

Whereas in the new Validate they are simply using the CRC polynomial
that is used in ZMODEM, ZIP files, and many other places.  There is
just one twist.  If a 32-bit CRC is performed with the CRC value
initialized to zero then it will not be able to detect a run of zeroes
at the beginning of the message, or file.  So it is common practice to
initialize the CRC to all ones (0xFFFFFFFF) and then, at the end,
performing a binary NOT operation on the CRC value.  The result is
that it can detect zeroes at the beginning of the message.

Well, Validate initializes to all ones, but it doesn't bother to
perform the NOT at the end, so the value that it returns is the
binary NOT of the CRC one would get from, say, a zip file directory.

The reason I say that this is a weaker method than employed by the
original Validate is because to forge a file so that the same numbers
would be shown by Validate as well as the unzipping program used to
require forging one 32-bit CRC and two 16-bit CRCs -- potentially as
hard as forging a 64-bit CRC, although that is not too difficult.
But it is now possible to forge just the 32-bit zip CRC, and this
will also confound Validate.

As for Valid8, it is not truly portable because it makes use of some
features that may only be present in DOS (I'm not sure how common or
standardized sys/stat.h is), but the central algorithm relies only on
the portable CRC-32 code combined with initializing to 0xffffffff and
addbfcrc()'ing your way through the data.  A very trivial example of
this is shown in the file pvalid8.c, which should be quite portable
so long as unsigned long is 32 bits wide.

Crc32.c and crc32.h are both freeware from Gary Brown.  Valid8.c and
Valid8.exe are freeware from David Conrad.  Pvalid8.c is hereby
released into the Public Domain.

Thanks to Vesselin Bontchev (bontchev@fbihh.informatik.uni-hamburg.de)
who relayed information from Olivier Montanuy (montanuy@LANNION.cnet.fr)
about the CRC polynomial used in VALIDATE 2.00.

David R. Conrad
David_Conrad@mts.cc.wayne.edu
ab411@detroit.freenet.org
