search menu icon-carat-right cmu-wordmark

Into the Black Box: A Case Study in Obtaining Visibility into Commercial Software

Technical Note
This 1999 report describes what we did to gain insight into Netscape's Communicator databases, the internal formats of the databases, and the password and encryption schemes used in the key3.db database.
Publisher

Software Engineering Institute

CMU/SEI Report Number
CMU/SEI-99-TN-010

Abstract

We were recently involved with a project that faced an interesting and not uncommon dilemma. The project needed to programmatically extract private keys and digital certificates from the Netscape Communicator v4.5 database. Netscape documentation was inadequate for us to figure out how to do this. As it turns out, this inadequacy was intentional-Netscape was concerned that releasing this information might possibly violate export control laws concerning encryption technology. Since our interest was in building a system and not exporting cryptographic technology, we decided to further investigate how to achieve our objectives even without support from Netscape. We restricted ourselves to the use of Netscape-provided code and documentation, and to information available on the Web. Our objective was to build our system, and to provide feedback to Netscape on how to engineer their product to provide the capability that we (and others) need, while not making the product vulnerable or expose the vendor to violations of export control laws. This paper describes our experiences peering "into the black box."

Cite This Technical Note

Plakosh, D., Hissam, S., & Wallnau, K. (1999, March 1). Into the Black Box: A Case Study in Obtaining Visibility into Commercial Software. (Technical Note CMU/SEI-99-TN-010). Retrieved March 3, 2024, from https://insights.sei.cmu.edu/library/into-the-black-box-a-case-study-in-obtaining-visibility-into-commercial-software/.

@techreport{plakosh_1999,
author={Plakosh, Daniel and Hissam, Scott and Wallnau, Kurt},
title={Into the Black Box: A Case Study in Obtaining Visibility into Commercial Software},
month={Mar},
year={1999},
number={CMU/SEI-99-TN-010},
howpublished={Carnegie Mellon University, Software Engineering Institute's Digital Library},
url={https://insights.sei.cmu.edu/library/into-the-black-box-a-case-study-in-obtaining-visibility-into-commercial-software/},
note={Accessed: 2024-Mar-3}
}

Plakosh, Daniel, Scott Hissam, and Kurt Wallnau. "Into the Black Box: A Case Study in Obtaining Visibility into Commercial Software." (CMU/SEI-99-TN-010). Carnegie Mellon University, Software Engineering Institute's Digital Library. Software Engineering Institute, March 1, 1999. https://insights.sei.cmu.edu/library/into-the-black-box-a-case-study-in-obtaining-visibility-into-commercial-software/.

D. Plakosh, S. Hissam, and K. Wallnau, "Into the Black Box: A Case Study in Obtaining Visibility into Commercial Software," Carnegie Mellon University, Software Engineering Institute's Digital Library. Software Engineering Institute, Technical Note CMU/SEI-99-TN-010, 1-Mar-1999 [Online]. Available: https://insights.sei.cmu.edu/library/into-the-black-box-a-case-study-in-obtaining-visibility-into-commercial-software/. [Accessed: 3-Mar-2024].

Plakosh, Daniel, Scott Hissam, and Kurt Wallnau. "Into the Black Box: A Case Study in Obtaining Visibility into Commercial Software." (Technical Note CMU/SEI-99-TN-010). Carnegie Mellon University, Software Engineering Institute's Digital Library, Software Engineering Institute, 1 Mar. 1999. https://insights.sei.cmu.edu/library/into-the-black-box-a-case-study-in-obtaining-visibility-into-commercial-software/. Accessed 3 Mar. 2024.

Plakosh, Daniel; Hissam, Scott; & Wallnau, Kurt. Into the Black Box: A Case Study in Obtaining Visibility into Commercial Software. CMU/SEI-99-TN-010. Software Engineering Institute. 1999. https://insights.sei.cmu.edu/library/into-the-black-box-a-case-study-in-obtaining-visibility-into-commercial-software/