full-disclosure - Re: Working exploit for Debian generated SSH Keys

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20080520085141.0208b8c7@wssyg114.sygroup-int.ch>
Date: Tue, 20 May 2008 08:51:41 +0200
From: Tonnerre Lombard <tonnerre.lombard@...roup.ch>
To: "Garrett M. Groff" <groffg@...design.com>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Working exploit for Debian generated SSH Keys

Salut, Garrett,

On Mon, 19 May 2008 13:51:29 -0400, Garrett M. Groff wrote:
> Generating pseudo-random numbers isn't hard given a good API, but
> writing that API is non-trivial (assuming you want high entropy/low
> predictability). And, apparently, screwing up that API is also very
> easy.

Generating real pseudo-random streams is a hard problem which is way
more than what people can handle. Usually, PRNGs are composed of
various periodic elements which, in the end, all combined produce a
repeating stream of pseudo-random numbers. OpenSSL uses a modified MAC
for this as a state machine and extracts some state bits as random
stream on every access.

We're not debating the PRNG itself here but the _seed_. OpenSSL
supports various ways to influence the state of the PRNG at various
stages by XORing in new material; however, Debian chose to only support
pre-seeding with uninitialized memory and the Process ID. With the
elimination of the uninitialized memory as seed, the seed for the MAC
was entirely comprised by the PID.

So we're not debating a weakness in the PRNG here at all, which is a
_very_ delicate subject.

				Tonnerre
-- 
SyGroup GmbH
Tonnerre Lombard

Solutions Systematiques
Tel:+41 61 333 80 33		Güterstrasse 86
Fax:+41 61 383 14 67		4053 Basel
Web:www.sygroup.ch		tonnerre.lombard@...roup.ch

Download attachment "signature.asc" of type "application/pgp-signature" (833 bytes)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/