bugtraq - Re: /dev/random is probably not

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <200507060937.39602.tom@electric-sheep.org>
Date: Wed, 6 Jul 2005 09:37:39 +0200
From: Thomas <tom@...ctric-sheep.org>
To: Darren Reed <avalon@...igula.anu.edu.au>
Cc: bugtraq@...urityfocus.com
Subject: Re: /dev/random is probably not


Am Mittwoch, 6. Juli 2005 09:14 schrieb Darren Reed:
> In some mail from Thomas, sie said:
                                             ^--- "sie"? :)
 

> > > Linux cited using keyboard interrupts.  How many of those happen on
> > > a web server in a rack, in an air conditioned computer room somewhere ?
> > > How many happen when you open up your web browser and select your
> > > internet banking web site from your bookmarks?
> >
> > To complete the list, Linux uses:
> > 	- block-device access
> > 	- interrupt occurence
> > 	- keyboard
> > 	- mouse
> > 	- freedback from pool extraction
> > 	- pool extraction timing (doesn't matter)
> >
> > Even w/o devices such as keyboard and mouse Linux starts
> > producing "a bit" entropy on an old notebook w/ just one hdd after
> > about 2200 events (the end-phase of a booting  SuSE Linux 9.0 system)
>
> And for all of those embedded devices which use compact flash (eliminate
> block-device access as being "random"), the list is only half complete.

Yes. Other sources should be added for such devices for sure.
But I think noone really does this.


> Just how good is the pool of random data going to be after powering on
> your Linux based embedded VPN access device?

Filled up with time in seconds and microseconds as well as the utsname.
Not much... but the microseconds may have some entropy.
Hopefully the old pool is restored right before the VPN software starts
negotiating.

Another application I fear is banking software on PocketPC/Palms. :(


> > Fortunately the pool is initialized in two stages... not perfect but
> > sufficient for most systems.
> >
> > Twisting and stirring the bits should scatter entropy evenly in the pool.
>
> You're missing the point.  If pi or e had good entropy, would they be a
> good data source ?  No, they're predictable.

They are random but don't have entropy.
The predictability is the difference between a random and an entrophic value.


> If you start of with the same X bits each time you reboot, even if you
> stir them up, the result is going to be predictable.

Sure.


> > Afterwards hashing the pool contents, feeding back the hash value,
> > and "folding" the hash value should be enough to stop every useful
> > attack.
>
> No.  See above.  This doesn't change the predictability.

I know... but you miss the initialization stages.

But this still leaves some interesting situation were key-breaking
is reduced to guessing the time + some statistical tests on a cloned system
to predict the internal pool state with p != 0.5 to reduce search space.


> > Unfortunately yes. At least for Linux I am not sure how accurate
> > the entropy estimation really is. At least during boot it is much too
> > optimistic.
>
> Entropy might be a measure of "randomness" but it is not a measure
> of predictability.

see above.


> Darren

Thomas Biege

-- 
Tom <tom@...ctric-sheep.org>
fingerprint = F055 43E5 1F3C 4F4F 9182  CD59 DBC6 111A 8516 8DBF