linux-kernel - Re: is "premature next" a real world rng concern, or just an academic exercise?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 11 May 2022 22:46:50 +0200
From:   Pavel Machek <pavel@....cz>
To:     Yevgeniy Dodis <dodis@...nyu.edu>
Cc:     "Jason A. Donenfeld" <Jason@...c4.com>, tytso <tytso@....edu>,
        Nadia Heninger <nadiah@...ucsd.edu>,
        Noah Stephens-Dawidowitz <noahsd@...il.com>,
        Stefano Tessaro <tessaro@...washington.edu>,
        torvalds@...ux-foundation.org, "D. J. Bernstein" <djb@...yp.to>,
        jeanphilippe.aumasson@...il.com, jann@...jh.net,
        keescook@...omium.org, gregkh@...uxfoundation.org,
        Peter Schwabe <peter@...ptojedi.org>,
        linux-crypto@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: is "premature next" a real world rng concern, or just an
 academic exercise?

Hi!

> >
> > Thank you for starting this fascinating discussion. I generally agree with everything Jason said. In particular, I am not
> > 100% convinced that the extra cost of the premature next defense is justified.(Although Windows and MacOS are adamant it is
> > worth it :).)
> >

Dunno, how big is cost of "premature next" defenses? I believe all you
need to do is to reseed in batches, and that does not seem costly at
runtime, and does not have high cost in kernel .text.

> > But let me give some meta points to at least convince you this is not as obvious as Jason makes it sound.
> >
> > 1) Attacking RNGs in any model is really hard. Heck, everybody knew for years that /dev/random is a mess
> > (and we published it formally in 2013, although this was folklore knowledge),  but in all these years nobody
> > (even Nadya's group :)) managed to find a practical attack. So just because the attack seems far-fetched, I do not think we should
> > lower our standards and do ugly stuff. Otherwise, just leave
> >/dev/random the way it was before Jason started his awesome work.

Well, practical attacks may be hard, but when they happen... that's
bad. We had weak keys generated by debian, we have various devices
that with deterministic rngs...

Best regards,
								Pavel
-- 
People of Russia, stop Putin before his war on Ukraine escalates.

Download attachment "signature.asc" of type "application/pgp-signature" (182 bytes)