full-disclosure - Re: how i stopped worrying and loved the backdoor

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20101225221246.GG13208@kevin>
Date: Sat, 25 Dec 2010 14:12:46 -0800
From: cpolish@...ewest.net
To: full-disclosure@...ts.grok.org.uk
Subject: Re: how i stopped worrying and loved the backdoor

BMF wrote:
> Dan Kaminsky <dan@...para.com> wrote:
> > Don't we have hardware RNG in most motherboard chipsets nowadays?
> 
> Do we? By what mechanism do they operate? Thermal noise seems the
> easiest way to go although I have always preferred the idea of
> sampling random radioactive decay simply for the purity of the
> immediate result. What is the quality of the entropy of the devices
> you speak of? How fast do they generate entropy? I have heard nothing
> about this. How could I tell if my machine had hw rng built in?
> 
> Some i810 series chipsets have hw rng. There is also the Intel 80802
> Firmware Hub chip that nobody seems to use anymore. I have heard of
> people pointing webcams at lava lamps and such to get random numbers.
 
Check out Markus Jacobsson et al, "A Practical Secure Physical Random
Bit Generator", 1998, using the turbulence of airflow inside the drive
as the source of randomness. Can't do much better than that.
-- 
Charles Polisher

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/