bugtraq - Re: /dev/random is probably not

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <200507060748.26443.tom@electric-sheep.org>
Date: Wed, 6 Jul 2005 07:48:25 +0200
From: Thomas <tom@...ctric-sheep.org>
To: bugtraq@...urityfocus.com
Cc: Darren Reed <avalon@...igula.anu.edu.au>, exon <exon@...e.se>
Subject: Re: /dev/random is probably not

> Linux cited using keyboard interrupts.  How many of those happen on
> a web server in a rack, in an air conditioned computer room somewhere ?
> How many happen when you open up your web browser and select your
> internet banking web site from your bookmarks?

To complete the list, Linux uses:
	- block-device access
	- interrupt occurence
	- keyboard
	- mouse
	- freedback from pool extraction
	- pool extraction timing (doesn't matter)

Even w/o devices such as keyboard and mouse Linux starts
producing "a bit" entropy on an old notebook w/ just one hdd after
about 2200 events (the end-phase of a booting  SuSE Linux 9.0 system)

Fortunately the pool is initialized in two stages... not perfect but
sufficient for most systems.

Twisting and stirring the bits should scatter entropy evenly in the pool.
Afterwards hashing the pool contents, feeding back the hash value,
and "folding" the hash value should be enough to stop every useful
attack.

Nevertheless I think it's time to retire for Linux' /dev/random implementation
and use new approaches like Ferguson's Fortuna.

> What the original article was getting at is that perhaps not all of
> the information you think of as random information going into your
> PRNG is actually random.  If that happens then even though the
> output of the PRNG "looks random", it may be predictable.

Unfortunately yes. At least for Linux I am not sure how accurate
the entropy estimation really is. At least during boot it is much too
optimistic.

> Darren

Thomas Biege

-- 
Tom <tom@...ctric-sheep.org>
fingerprint = F055 43E5 1F3C 4F4F 9182  CD59 DBC6 111A 8516 8DBF