[117594] in Cypherpunks
Re: Build a better OTP?
daemon@ATHENA.MIT.EDU (Rabid Wombat)
Mon Sep 6 19:29:36 1999
Date: Mon, 6 Sep 1999 18:59:53 -0400
From: Rabid Wombat <wombat@mayhem.snakecult.org>
To: Anonymous <nobody@replay.com>
cc: cypherpunks@cyberpass.net
In-Reply-To: <199909062238.AAA11320@mail.replay.com>
Message-ID: <Pine.SGI.4.10.9909061856450.14426-100000@mayhem.snakecult.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Reply-To: Rabid Wombat <wombat@mayhem.snakecult.org>
I would trust the hardware on a 486 or early pentuim running BSD or Linux.
Anything beyond that is getting iffy.
"Just because you're paranoid doesn't mean there's no one out to get you."
Remember a certain Swiss crypto gear manufacturer? Biggest score the NSA
ever pulled off. Way better than the Xerox story that's been floating
around the last few days.
-r.w.
On Tue, 7 Sep 1999, Anonymous wrote:
> > >> Has anyone designed a true random number generator that runs at high
> > >> speed? Something that could fill a CD or DVD in a reasonable amount of
> > >> time?
> >
> > >Yes, there's one out by a little company called Intel. You might have
> > >heard of them.
> >
> > Yes but is it trustworthy?
>
> Your naive paranoia would be charming if it weren't so tiresome.
>
> The basic design is sound; see http://www.cryptography.com/intelRNG.pdf
> for a review by Ben Jun and Paul Kocher, two of the smartest guys around
> when it comes to real-world implementations of crypto technology:
>
> Cryptographically, we believe that the Intel RNG is strong and that
> it is unlikely that any computationally feasible test will be found
> to distinguish data produced by Intel's RNG library from output from
> a perfect RNG. As a result, we believe that the RNG is by far the
> most reliable source of secure random data available in the PC.
>
> As for the hoary old cypherpunk concern about hardware backdoors, how
> do you know your CPU is trustworthy? How about your memory chips, or
> your ethernet chip? How do you know your motherboard doesn't have a
> built-in snoop chip, or your keyboard?
>
> Paranoia is fun but try joining the real world once in a while. Come back
> when you've designed your own CPU chip so you know you can trust it. Oh,
> yeah, let us know when you've built your own fab, too. Good cypherpunks
> would never settle for anything less, right?
>
