bugtraq - Re: /dev/random is probably not

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <17098.41040.551604.611443@gargle.gargle.HOWL>
Date: Tue, 5 Jul 2005 15:59:28 +0100
From: Glynn Clements <glynn@...ements.plus.com>
To: "Zow" Terry Brugger <zow@...l.gov>
Cc: Chiaki <ishikawa@...rim.or.jp>, bugtraq@...urityfocus.com,
	"Charles M. Hannum" <mycroft@...bsd.org>
Subject: Re: /dev/random is probably not



"Zow" Terry Brugger wrote:

> It's been a while since I looked at the /dev/random design on Linux
> (probably the early 2.4 days), however one thing that was quite
> clear was that they did not use any network I/O as entropy sources
> because an attacker, particularly one that already had control of
> other machines on the same LAN segment, could have a high degree of
> control over that source.

They don't need to have any control; simply being able to observe
network traffic means that it is no longer random (in the sense of
"unpredictable", which is what counts from a security perspective).

-- 
Glynn Clements <glynn@...ements.plus.com>