[39517] in bugtraq
Re: /dev/random is probably not
daemon@ATHENA.MIT.EDU (Kai Howells)
Fri Jul 8 14:29:02 2005
Mime-Version: 1.0 (Apple Message framework v730)
In-Reply-To: <200507060748.26443.tom@electric-sheep.org>
Content-Type: multipart/signed; micalg=sha1; boundary=Apple-Mail-29-656466223; protocol="application/pkcs7-signature"
Message-Id: <434FEC79-19E4-436A-A8FA-18CF19403169@icorp.com.au>
From: Kai Howells <kai.howells@icorp.com.au>
Date: Thu, 7 Jul 2005 10:53:06 +1000
To: bugtraq@securityfocus.com
--Apple-Mail-29-656466223
Content-Transfer-Encoding: 7bit
Content-Type: text/plain;
charset=US-ASCII;
delsp=yes;
format=flowed
As for the issue of getting randomness on a freshly-booted system,
Mac OS X will collect entropy over time and dump some to disk to be
reloaded next time the system reboots.
From the random (4) manpage:
OPERATION
The random device implements the Yarrow pseudo random number
generator
algorithm and maintains its entropy pool. Addditional entropy
is fed to
the generator regularly by the SecurityServer daemon from
random jitter
measurements of the kernel. SecurityServer is also responsible
for peri-
odically saving some entropy to disk and reloading it during
startup to
provide entropy in early system operation.
You may feed additional entropy to the generator by writing it
to the
random device, though this is not required in a normal
operating environ-
ment.
Now this raises some interesting issues - such as where is the
entropy written to, and how much does this pool of entropy set the
state of the RNG after bootup - ie, if an attacker had control of
this file, could they influence the RNG in a deterministic fashion
after forcing a reboot?
Kai Howells
On 06/07/2005, at 3:48 PM, Thomas wrote:
>> Linux cited using keyboard interrupts. How many of those happen on
>> a web server in a rack, in an air conditioned computer room
>> somewhere ?
>> How many happen when you open up your web browser and select your
>> internet banking web site from your bookmarks?
>>
>
> To complete the list, Linux uses:
> - block-device access
> - interrupt occurence
> - keyboard
> - mouse
> - freedback from pool extraction
> - pool extraction timing (doesn't matter)
>
> Even w/o devices such as keyboard and mouse Linux starts
> producing "a bit" entropy on an old notebook w/ just one hdd after
> about 2200 events (the end-phase of a booting SuSE Linux 9.0 system)
>
> Fortunately the pool is initialized in two stages... not perfect but
> sufficient for most systems.
>
> Twisting and stirring the bits should scatter entropy evenly in the
> pool.
> Afterwards hashing the pool contents, feeding back the hash value,
> and "folding" the hash value should be enough to stop every useful
> attack.
>
> Nevertheless I think it's time to retire for Linux' /dev/random
> implementation
> and use new approaches like Ferguson's Fortuna.
>
>
>
>> What the original article was getting at is that perhaps not all of
>> the information you think of as random information going into your
>> PRNG is actually random. If that happens then even though the
>> output of the PRNG "looks random", it may be predictable.
>>
>
> Unfortunately yes. At least for Linux I am not sure how accurate
> the entropy estimation really is. At least during boot it is much too
> optimistic.
>
>
>
>> Darren
>>
>
> Thomas Biege
>
> --
> Tom <tom@electric-sheep.org>
> fingerprint = F055 43E5 1F3C 4F4F 9182 CD59 DBC6 111A 8516 8DBF
>
>
--Apple-Mail-29-656466223
Content-Transfer-Encoding: base64
Content-Type: application/pkcs7-signature;
name=smime.p7s
Content-Disposition: attachment;
filename=smime.p7s
MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIGJDCCAt0w
ggJGoAMCAQICAw4P0DANBgkqhkiG9w0BAQQFADBiMQswCQYDVQQGEwJaQTElMCMGA1UEChMcVGhh
d3RlIENvbnN1bHRpbmcgKFB0eSkgTHRkLjEsMCoGA1UEAxMjVGhhd3RlIFBlcnNvbmFsIEZyZWVt
YWlsIElzc3VpbmcgQ0EwHhcNMDUwMjE3MDQwNDMxWhcNMDYwMjE3MDQwNDMxWjBKMR8wHQYDVQQD
ExZUaGF3dGUgRnJlZW1haWwgTWVtYmVyMScwJQYJKoZIhvcNAQkBFhhrYWkuaG93ZWxsc0BpY29y
cC5jb20uYXUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDsi1bWdTRVzcnJNZRrB3I5
9KXpQz1yjwuK54+6FzQvFIwNq2BN8AW0ZxbQ/3s3NpXsyBqXwcvlY0hOV5RoN9H1e+6T5fIvtZWx
QeG3LlNxhOSXyQ7zrcnqcjpX57DjIOBvhnuxvWtEPjMR8hoItWQVqVexmAkjQOTBUHdPvbAhH7jL
JEEe6C0+50RX3R8Y4H+/jorE3giLLIRz220Z58wluwURN+NNzSv3huRpdBh2Vz8ef+s/2LyGE1ap
SgEe16thqPFQAY7TNO1/K54eo3P4NhiWQq13Cda6WlKWWpUGH8/YDQHZMI6ocdSJeiV6lsaazs+z
Lc2V5EUfAyOC2RGDAgMBAAGjNTAzMCMGA1UdEQQcMBqBGGthaS5ob3dlbGxzQGljb3JwLmNvbS5h
dTAMBgNVHRMBAf8EAjAAMA0GCSqGSIb3DQEBBAUAA4GBAMM427TOGppc3A3fBHVP9x4DbWBY/inV
Z/CWJpjduuEBdhiZaXlONlbZqiFR+l4b8DlTSZVmLnyNVhUJPW/4NLZdYnrgxT0qwek//sHTghim
PUStG6hKwR2gltyOY05Xa4sHwinA30UoUX18Y+xiaIgsiTwuTxxPQrIIMSla/4emMIIDPzCCAqig
AwIBAgIBDTANBgkqhkiG9w0BAQUFADCB0TELMAkGA1UEBhMCWkExFTATBgNVBAgTDFdlc3Rlcm4g
Q2FwZTESMBAGA1UEBxMJQ2FwZSBUb3duMRowGAYDVQQKExFUaGF3dGUgQ29uc3VsdGluZzEoMCYG
A1UECxMfQ2VydGlmaWNhdGlvbiBTZXJ2aWNlcyBEaXZpc2lvbjEkMCIGA1UEAxMbVGhhd3RlIFBl
cnNvbmFsIEZyZWVtYWlsIENBMSswKQYJKoZIhvcNAQkBFhxwZXJzb25hbC1mcmVlbWFpbEB0aGF3
dGUuY29tMB4XDTAzMDcxNzAwMDAwMFoXDTEzMDcxNjIzNTk1OVowYjELMAkGA1UEBhMCWkExJTAj
BgNVBAoTHFRoYXd0ZSBDb25zdWx0aW5nIChQdHkpIEx0ZC4xLDAqBgNVBAMTI1RoYXd0ZSBQZXJz
b25hbCBGcmVlbWFpbCBJc3N1aW5nIENBMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDEpjxV
c1X7TrnKmVoeaMB1BHCd3+n/ox7svc31W/Iadr1/DDph8r9RzgHU5VAKMNcCY1osiRVwjt3J8CuF
Wqo/cVbLrzwLB+fxH5E2JCoTzyvV84J3PQO+K/67GD4Hv0CAAmTXp6a7n2XRxSpUhQ9IBH+nttE8
YQRAHmQZcmC3+wIDAQABo4GUMIGRMBIGA1UdEwEB/wQIMAYBAf8CAQAwQwYDVR0fBDwwOjA4oDag
NIYyaHR0cDovL2NybC50aGF3dGUuY29tL1RoYXd0ZVBlcnNvbmFsRnJlZW1haWxDQS5jcmwwCwYD
VR0PBAQDAgEGMCkGA1UdEQQiMCCkHjAcMRowGAYDVQQDExFQcml2YXRlTGFiZWwyLTEzODANBgkq
hkiG9w0BAQUFAAOBgQBIjNFQg+oLLswNo2asZw9/r6y+whehQ5aUnX9MIbj4Nh+qLZ82L8D0HFAg
k3A8/a3hYWLD2ToZfoSxmRsAxRoLgnSeJVCUYsfbJ3FXJY3dqZw5jowgT2Vfldr394fWxghOrvbq
NOUQGls1TXfjViF4gtwhGTXeJLHTHUb/XV9lTzGCAucwggLjAgEBMGkwYjELMAkGA1UEBhMCWkEx
JTAjBgNVBAoTHFRoYXd0ZSBDb25zdWx0aW5nIChQdHkpIEx0ZC4xLDAqBgNVBAMTI1RoYXd0ZSBQ
ZXJzb25hbCBGcmVlbWFpbCBJc3N1aW5nIENBAgMOD9AwCQYFKw4DAhoFAKCCAVMwGAYJKoZIhvcN
AQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMDUwNzA3MDA1MzA3WjAjBgkqhkiG9w0B
CQQxFgQU/tuyDC5gwaKwf9mYyS4XIAObM58weAYJKwYBBAGCNxAEMWswaTBiMQswCQYDVQQGEwJa
QTElMCMGA1UEChMcVGhhd3RlIENvbnN1bHRpbmcgKFB0eSkgTHRkLjEsMCoGA1UEAxMjVGhhd3Rl
IFBlcnNvbmFsIEZyZWVtYWlsIElzc3VpbmcgQ0ECAw4P0DB6BgsqhkiG9w0BCRACCzFroGkwYjEL
MAkGA1UEBhMCWkExJTAjBgNVBAoTHFRoYXd0ZSBDb25zdWx0aW5nIChQdHkpIEx0ZC4xLDAqBgNV
BAMTI1RoYXd0ZSBQZXJzb25hbCBGcmVlbWFpbCBJc3N1aW5nIENBAgMOD9AwDQYJKoZIhvcNAQEB
BQAEggEArMj+RJZrlFiNiOXq12ONNvk99jC9jeZfb2+jbcghgFNXAJivuHFwpAUxJMDJ9WGiTj3+
8qs75qfEoAfQHPOUJWC1HElXCwbtCa2QwYnJwpB2AZ5G61YavFp1GEBp+kDvRXEHt0CBwiPdNhH4
9D/xJbLyXEoSfcEGLr6Q/88yFk4t4vIR62I6nIVBkFlB4RI9wMBvoRVsoGtfRJ5d+/vP+zgGiF1K
7sO0Y2Hu0OZpCBMV5Ra53WO0OIAWJUgDxhXNgqm18RWrDqi1mbRz47+M1enrJyJfraBk07P+SP6j
itVvuQoXXdl+2HDvEYZ0K7m2o1i+gaow9/kdvLuxw0r00gAAAAAAAA==
--Apple-Mail-29-656466223--
