bugtraq - Re: /dev/random is probably not

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <72a6fbc05070516252c188fbf@mail.gmail.com>
Date: Tue, 5 Jul 2005 16:25:11 -0700
From: ChayoteMu <chayotemu@...il.com>
To: Glynn Clements <glynn@...ements.plus.com>
Cc: Zow Terry Brugger <zow@...l.gov>, Chiaki <ishikawa@...rim.or.jp>,
	bugtraq@...urityfocus.com, "Charles M. Hannum" <mycroft@...bsd.org>
Subject: Re: /dev/random is probably not

It's not necessarily the traffic itself, but aspects of the traffic.
Someone had mentioned that the timing between recieving the packets
was what's used, even if you see that it may change over the rest of
the wire and there's nothing to say that the system is using all the
traffic as the attacker sees it. Drop every 5th packet and hash the
result with the time and the attack doesn't have anything to work
with. Just because you can observe or control one aspect doesn't mean
you can observe/control the entire thing.

On 7/5/05, Glynn Clements <glynn@...ements.plus.com> wrote:
> 
> "Zow" Terry Brugger wrote:
> 
> > It's been a while since I looked at the /dev/random design on Linux
> > (probably the early 2.4 days), however one thing that was quite
> > clear was that they did not use any network I/O as entropy sources
> > because an attacker, particularly one that already had control of
> > other machines on the same LAN segment, could have a high degree of
> > control over that source.
> 
> They don't need to have any control; simply being able to observe
> network traffic means that it is no longer random (in the sense of
> "unpredictable", which is what counts from a security perspective).
> 
> --
> Glynn Clements <glynn@...ements.plus.com>
> 

-- 
"To catch a thief, think like a thief. To catch a master thief, be a
master thief."