Bugtraq mailing list archives
Re: /dev/random is probably not
From: ChayoteMu <chayotemu () gmail com>
Date: Tue, 5 Jul 2005 16:25:11 -0700
It's not necessarily the traffic itself, but aspects of the traffic. Someone had mentioned that the timing between recieving the packets was what's used, even if you see that it may change over the rest of the wire and there's nothing to say that the system is using all the traffic as the attacker sees it. Drop every 5th packet and hash the result with the time and the attack doesn't have anything to work with. Just because you can observe or control one aspect doesn't mean you can observe/control the entire thing. On 7/5/05, Glynn Clements <glynn () gclements plus com> wrote:
"Zow" Terry Brugger wrote:It's been a while since I looked at the /dev/random design on Linux (probably the early 2.4 days), however one thing that was quite clear was that they did not use any network I/O as entropy sources because an attacker, particularly one that already had control of other machines on the same LAN segment, could have a high degree of control over that source.They don't need to have any control; simply being able to observe network traffic means that it is no longer random (in the sense of "unpredictable", which is what counts from a security perspective). -- Glynn Clements <glynn () gclements plus com>
-- "To catch a thief, think like a thief. To catch a master thief, be a master thief."
Current thread:
- Re: /dev/random is probably not, (continued)
- Re: /dev/random is probably not Darren Reed (Jul 06)
- Re: /dev/random is probably not Thomas (Jul 06)
- Re: /dev/random is probably not Kai Howells (Jul 08)
- Re: /dev/random is probably not Stefan Bethke (Jul 08)
- Re: /dev/random is probably not Francesco Messineo (Jul 12)
- Re: /dev/random is probably not Zow (Jul 04)
- Re: /dev/random is probably not Anton Ivanov (Jul 05)
- Re: /dev/random is probably not devnull (Jul 06)
- RE: /dev/random is probably not David Schwartz (Jul 05)
- Re: /dev/random is probably not Glynn Clements (Jul 05)
- Re: /dev/random is probably not ChayoteMu (Jul 06)
- Re: /dev/random is probably not Jack Lloyd (Jul 05)
- Re: /dev/random is probably not Alexey Toptygin (Jul 06)
- Re: /dev/random is probably not Chris Kuethe (Jul 06)
- Re: /dev/random is probably not Thomas (Jul 06)
- RE: /dev/random is probably not David Schwartz (Jul 08)