Cooperating networked CSPRNGs


It occurred to me that several cooperating networked CSPRNGs could derive entropy from messages received from each other. For instance, Alice, Bob and Mallory each set up a Fortuna instance. Each of them then at suitable intervals executes the following protocol as Sender with another participant as Responder.
1. Sender makes up an ephemeral DH keypair.
2. Sender sends the public key to Responder.
3. Sender receives the Responder's public key.
4. Sender calculate the shared secret.
5. Sender treats the result of 4 like any other source of entropy.
To prevent step 3 from waiting forever, participants also execute the Responder's role when an unsolicited public key arrives:
A. Responder uses its own PRNG to make up an ephemeral keypair.
B. Responder sends that fresh public key to the Sender of the unsolicited public key.
C. Responder calculates the shared secret and treats it as an entropy source.

The protocol allows a participant to bring up its entropy closer to its partner's when the partner has more. Against adversaries who are not monitoring the network, this can take the participant's state from being guessable to being unguessable. An adversary who can guess a participant's state and can see the partner's public key can calculate the shared secret.
An adversary trying to guess a participant's state can use the participant's ephemeral public key to confirm the guess, but that's true for any output from the CSPRNG.

Does anyone see any drawbacks that I have missed?

--Mike Amling
.

Relevant Pages

  • Re: [SLE] pgp howto
    ... >> I'm assuming pgadmin3-1.4.1.tar.gz.sig is the signed public key. ... >> the concept of Digital Signatures was invented. ... >> message is digitally signed by the sender. ... >> want to be doing is climbing the learning curve of pgadmin3. ...
    (SuSE)
  • M^k mod ns, M^k mod nr, if nr!=ns, can we receive the same plaintext?
    ... receiver R, each owns a RSA public key and private key. ... the sender is denoted by while the private key is denoted by ...
    (sci.crypt)
  • Re: Is symmetric key distribution equivalent to symmetric key generation?
    ... > it to Bob encrypted under Bob's public key (the very simplest way ... The sender knows only the intended recipient can obtain the ... session key, but the receiver does not know who sent it. ...
    (sci.crypt)
  • Re: I need a encryption utility that will...
    ... >utility, so when they specify one or more files for inclusion, they just ... - with that the sender can encrypt information so that only the ... you will periodically provide new copies of your public key ... it's also possible for the senders to create their own private keys, ...
    (comp.security.misc)
Quantcast