Am I the only guy who can't figure out how to navigate mailing lists archives?
These things are internet hell.
How secure is Linux's random number generator?
11–20 of 100 posts
Re: How secure is Linux's random number generator?
#12Just because something is closed source doesn't mean it's insecure. RdRand meets various standards for RNGs and the dieharder tests don't show anything of concern. While you can't be 100 percent sure of the reliability of RdRand because you can't audit it, I feel safe trusting it for all but the most critical of applications. Here's a blog post describing testing RdRand with dieharder: http://smackerelofopinion.blogs…
You are right that closed source doesn't mean its insecure - on the other hand, open source could prove that it is indeed secure. With new scandals coming up every week these days, about hidden backdoors in security software, I trust open source more than ever before.
Ironically, it's particularly vis a vis cryptographic random number generation where we can most easily show open source cryptography failing its users; Debian fatally broke the OpenSSL CSPRNG so badly that attackers could remotely brute force SSH keys.
Re: How secure is Linux's random number generator?
#13Just because something is closed source doesn't mean it's insecure. RdRand meets various standards for RNGs and the dieharder tests don't show anything of concern. While you can't be 100 percent sure of the reliability of RdRand because you can't audit it, I feel safe trusting it for all but the most critical of applications. Here's a blog post describing testing RdRand with dieharder: http://smackerelofopinion.blogs…
But how can you be sure it's not just a very very good self-synchronising PRNG?
f(, , ) =
Re: How secure is Linux's random number generator?
#14Am I the only guy who can't figure out how to navigate mailing lists archives? These things are internet hell.
I agree. Try searching for the title on gmane.org
Re: How secure is Linux's random number generator?
#15Earlier quoted context omitted.
You are right that closed source doesn't mean its insecure - on the other hand, open source could prove that it is indeed secure. With new scandals coming up every week these days, about hidden backdoors in security software, I trust open source more than ever before.
Ironically, it's particularly vis a vis cryptographic random number generation where we can most easily show open source cryptography failing its users; Debian fatally broke the OpenSSL CSPRNG so badly that attackers could remotely brute force SSH keys.
[deleted]
Re: How secure is Linux's random number generator?
#16Just because something is closed source doesn't mean it's insecure. RdRand meets various standards for RNGs and the dieharder tests don't show anything of concern. While you can't be 100 percent sure of the reliability of RdRand because you can't audit it, I feel safe trusting it for all but the most critical of applications. Here's a blog post describing testing RdRand with dieharder: http://smackerelofopinion.blogs…
But how can you be sure it's not just a very very good self-synchronising PRNG? f( , , ) =
[deleted]
Re: How secure is Linux's random number generator?
#17And here is the mailing list thread that the author refers to: https://lkml.org/lkml/2011/7/29/366
And even Linus talks about the NSA in that same thread a little lower: https://lkml.org/lkml/2011/7/30/116
And the next email where Ted says that the NSA are one of the good guys... Yeah, not so much.
Re: How secure is Linux's random number generator?
#18Earlier quoted context omitted.
And even Linus talks about the NSA in that same thread a little lower: https://lkml.org/lkml/2011/7/30/116
And the next email where Ted says that the NSA are one of the good guys... Yeah, not so much.
You just took T'so's quote totally out of context in order to make a fatuous point. In reality, Torvalds and T'so have a better understanding of software security topics than virtually anyone who comments on HN.
Re: How secure is Linux's random number generator?
#19Just because something is closed source doesn't mean it's insecure. RdRand meets various standards for RNGs and the dieharder tests don't show anything of concern. While you can't be 100 percent sure of the reliability of RdRand because you can't audit it, I feel safe trusting it for all but the most critical of applications. Here's a blog post describing testing RdRand with dieharder: http://smackerelofopinion.blogs…
Meeting various standards for RNGs doesn't help though if the algorithm is properly backdoored. Like for instance Dual_EC_DRBG could be..
Also correct me if I am wrong, but wasn't this about using RdRand as entropy source to the linux /dev/random, which afaik is not injection-proof..
And I would consider /dev/random among the most critial of applications.
Re: How secure is Linux's random number generator?
#20Earlier quoted context omitted.
You are right that closed source doesn't mean its insecure - on the other hand, open source could prove that it is indeed secure. With new scandals coming up every week these days, about hidden backdoors in security software, I trust open source more than ever before.
Ironically, it's particularly vis a vis cryptographic random number generation where we can most easily show open source cryptography failing its users; Debian fatally broke the OpenSSL CSPRNG so badly that attackers could remotely brute force SSH keys.
Whereas with closed source you would almost never know. Crypto is very hard to do properly, but at least with open source you have the possibility of independent third party analysis.