How secure is Linux's random number generator?
lists.randombit.net
How secure is Linux's random number generator?
1–10 of 100 posts
Re: How secure is Linux's random number generator?
#2And here is the mailing list thread that the author refers to:
Re: How secure is Linux's random number generator?
#3Prior two Edward Snowden's whistle blowing I think you could perceive the maintainer as paranoid around leaving the project (see linked thread) however now I think you can't discount what, if any, cooperation technology companies have been providing to the NSA.
Re: How secure is Linux's random number generator?
#4For those that aren't aware, the security of a rand number generator is very important: http://en.wikipedia.org/wiki/Random_number_generator_attack
Re: How secure is Linux's random number generator?
#5Just because something is closed source doesn't mean it's insecure. RdRand meets various standards for RNGs and the dieharder tests don't show anything of concern. While you can't be 100 percent sure of the reliability of RdRand because you can't audit it, I feel safe trusting it for all but the most critical of applications. Here's a blog post describing testing RdRand with dieharder: http://smackerelofopinion.blogspot.com/2012/10/intel-rdrand-...
Re: How secure is Linux's random number generator?
#6And here is the mailing list thread that the author refers to: https://lkml.org/lkml/2011/7/29/366
And even Linus talks about the NSA in that same thread a little lower: https://lkml.org/lkml/2011/7/30/116
Re: How secure is Linux's random number generator?
#7Just because something is closed source doesn't mean it's insecure. RdRand meets various standards for RNGs and the dieharder tests don't show anything of concern. While you can't be 100 percent sure of the reliability of RdRand because you can't audit it, I feel safe trusting it for all but the most critical of applications. Here's a blog post describing testing RdRand with dieharder: http://smackerelofopinion.blogs…
You are right that closed source doesn't mean its insecure - on the other hand, open source could prove that it is indeed secure. With new scandals coming up every week these days, about hidden backdoors in security software, I trust open source more than ever before.
Re: How secure is Linux's random number generator?
#8Prior two Edward Snowden's whistle blowing I think you could perceive the maintainer as paranoid around leaving the project (see linked thread) however now I think you can't discount what, if any, cooperation technology companies have been providing to the NSA.
I am not sure I agree that before Snowden this could have been perceived as paranoid. As part of the discussion on the crypto list Ben Laurie brings up an important point:
"But what's the argument for _not_ mixing their probably-not-backdoored RNG with other entropy?"[1]
Does your answer to this really change that much "pre-Snowden"?
[1] http://lists.randombit.net/pipermail/cryptography/2013-July/...
Re: How secure is Linux's random number generator?
#9Just because something is closed source doesn't mean it's insecure. RdRand meets various standards for RNGs and the dieharder tests don't show anything of concern. While you can't be 100 percent sure of the reliability of RdRand because you can't audit it, I feel safe trusting it for all but the most critical of applications. Here's a blog post describing testing RdRand with dieharder: http://smackerelofopinion.blogs…
As you said,
"While you can't be 100 percent sure of the reliability of RdRand because you can't audit it"
So, if you are willing to disregard the importance of auditing a (critical!) piece of code, and take and use a nice black box given to you by that big company, then it begs the question.... Why on earth are you using open source??
It just makes no sense. To me, at least.
Re: How secure is Linux's random number generator?
#10Just because something is closed source doesn't mean it's insecure. RdRand meets various standards for RNGs and the dieharder tests don't show anything of concern. While you can't be 100 percent sure of the reliability of RdRand because you can't audit it, I feel safe trusting it for all but the most critical of applications. Here's a blog post describing testing RdRand with dieharder: http://smackerelofopinion.blogs…
You are right that closed source doesn't mean its insecure - on the other hand, open source could prove that it is indeed secure. With new scandals coming up every week these days, about hidden backdoors in security software, I trust open source more than ever before.
Open source would not prove it is secure. At best, you could look for obvious attacks. Cryptography is hard.