linux-kernel - Re: [PATCH 3/6] random: do extraction before mixing

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20071209071226.GW19691@waste.org>
Date:	Sun, 9 Dec 2007 01:12:26 -0600
From:	Matt Mackall <mpm@...enic.com>
To:	Theodore Tso <tytso@....edu>,
	Andrew Morton <akpm@...ux-foundation.org>,
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH 3/6] random: do extraction before mixing

On Sat, Dec 08, 2007 at 07:35:54PM -0500, Theodore Tso wrote:
> On Sat, Dec 08, 2007 at 05:20:17PM -0600, Matt Mackall wrote:
> > random: do extraction before mixing
> > 
> > If an attacker manages to capture the current pool state, she can
> > determine the last 10 bytes extracted from the pool. 
> 
> That's not true; we aren't just extracting data in the
> __add_entropy_words() call.  In fact, above that, the bulk of the
> extraction comes form when we hash the entire pool, feeding back a
> portion of the hash into the pool here:
> 
> 	for (i = 0; i < r->poolinfo->poolwords; i += 16) {
> 		/* hash blocks of 16 words = 512 bits */
> 		sha_transform(buf, (__u8 *)(r->pool + i), buf + 5);
> 		/* feed back portion of the resulting hash */
> 		add_entropy_words(r, &buf[i % 5], 1);
> 	}

Ok, yes, I'd forgotten we were chaining in the final sha_transform. I
plead too many bufs and buf+5s, which I fix up in 6/6. Funny thing is
that I'd convinced myself that this attack didn't work (correct) last
year when I read the paper I mentioned earlier. But yesterday and
today I couldn't spot the problem with it. So again, I'll add an
explicit comment for future hackers and researchers.

-- 
Mathematics is the supreme nostalgia of our time.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/