Re: /dev/random is probably not

From: Alexey Toptygin (alexeyt_at_freeshell.org)
Date: 07/06/05

  • Next message: Tobias Glemser: "VoIP-Phones: Weakness in proccessing SIP-Notify-Messages" 
    Date: Wed, 6 Jul 2005 11:37:00 +0000 (UTC)
To: Jack Lloyd <lloyd@randombit.net>

    On Tue, 5 Jul 2005, Jack Lloyd wrote:

    > Assuming the PRNG is any good, it shouldn't matter if an attacker can
    > manipulate such timings, because (by definition) a good PRNG will still
    > behave correctly even if an attacker does feed it lots of deliberately
    > bad data (as long as the PRNG also has been fed with a sufficient amount
    > of unguessable 'good' input as well, of course).

    In the case of Linux, this still causes the estimate of how much 'good'
    entropy is in the pool to be inflated. Some applications may rely on the
    fact that /dev/random is backed by 'real' entropy, whereas /dev/urandom
    can be pure PRNG output.

    IMO, all this discussion is well and good, but it would be much more
    productive for someone to settle the question empirically.

                             Alexey

  • Next message: Tobias Glemser: "VoIP-Phones: Weakness in proccessing SIP-Notify-Messages"

    Relevant Pages

    • Re: strengthening /dev/urandom
      ... The input is not there for an attacker to get at. ... ]entropy then you have no "security" at all. ... ]thought out PRNG as the device. ... which is not under anyone's possible control, ...
      (sci.crypt)
    • Re: new /dev/random
      ... For a proper PRNG, with the assumption that the algorithms are robust, ... is said to contain 40 bits of entropy if I could, ... If I want to attack a stream of 56 bits produced by a PRNG with a seed ... RNG resistance therefore relies on the same two classes of assumptions ...
      (sci.crypt)
    • Re: Alternative rand()-algorithm?
      ... But you, or any competent attacker, could find out with little ... matter of iterating the shuffling algorithm through seed values. ... And each output from that PRNG will leak some of that state. ... Periodic reseeding compensates for the entropy lost in the PRNG ...
      (comp.lang.c)
    • Re: Alternative rand()-algorithm?
      ... > But you, or any competent attacker, could find out with little ... > matter of iterating the shuffling algorithm through seed values. ... And each output from that PRNG will leak some of that state. ... > Periodic reseeding compensates for the entropy lost in the PRNG ...
      (comp.lang.c)
    • Re: new /dev/random
      ... > is said to contain 40 bits of entropy if I could, ... > efficient attack would be to try the exhaustive search on the seed. ... > than the PRNG: evolution of computer science (the robustness of the ... > because, for a given length of random bits requested, the RNG will have ...
      (sci.crypt)