Re: /dev/random is probably not

[Kai Howells <kai.howells () icorp com au>]

As for the issue of getting randomness on a freshly-booted system,  
Mac OS X will collect entropy over time and dump some to disk to be  
reloaded next time the system reboots.
From the random (4) manpage:

OPERATION
     The random device implements the Yarrow pseudo random number  
generator
     algorithm and maintains its entropy pool.  Addditional entropy  
is fed to
     the generator regularly by the SecurityServer daemon from  
random jitter
     measurements of the kernel.  SecurityServer is also responsible  
for peri-
     odically saving some entropy to disk and reloading it during  
startup to
     provide entropy in early system operation.

     You may feed additional entropy to the generator by writing it  
to the
     random device, though this is not required in a normal  
operating environ-
     ment.

Now this raises some interesting issues - such as where is the  
entropy written to, and how much does this pool of entropy set the  
state of the RNG after bootup - ie, if an attacker had control of  
this file, could they influence the RNG in a deterministic fashion  
after forcing a reboot?

Kai Howells

On 06/07/2005, at 3:48 PM, Thomas wrote:

> > Linux cited using keyboard interrupts.  How many of those happen on
> > a web server in a rack, in an air conditioned computer room  
> > somewhere ?
> > How many happen when you open up your web browser and select your
> > internet banking web site from your bookmarks?
>
> To complete the list, Linux uses:
>     - block-device access
>     - interrupt occurence
>     - keyboard
>     - mouse
>     - freedback from pool extraction
>     - pool extraction timing (doesn't matter)
>
> Even w/o devices such as keyboard and mouse Linux starts
> producing "a bit" entropy on an old notebook w/ just one hdd after
> about 2200 events (the end-phase of a booting  SuSE Linux 9.0 system)
>
> Fortunately the pool is initialized in two stages... not perfect but
> sufficient for most systems.
>
> Twisting and stirring the bits should scatter entropy evenly in the  
> pool.
> Afterwards hashing the pool contents, feeding back the hash value,
> and "folding" the hash value should be enough to stop every useful
> attack.
>
> Nevertheless I think it's time to retire for Linux' /dev/random  
> implementation
> and use new approaches like Ferguson's Fortuna.
>
>
>
> > What the original article was getting at is that perhaps not all of
> > the information you think of as random information going into your
> > PRNG is actually random.  If that happens then even though the
> > output of the PRNG "looks random", it may be predictable.
>
> Unfortunately yes. At least for Linux I am not sure how accurate
> the entropy estimation really is. At least during boot it is much too
> optimistic.
>
>
>
> > Darren
>
> Thomas Biege
>
> --
> Tom <tom () electric-sheep org>
> fingerprint = F055 43E5 1F3C 4F4F 9182  CD59 DBC6 111A 8516 8DBF

Attachment: smime.p7s
Description: