How secure is Linux's random number generator?

Post by caf » Sun, Jul 14, 2013, 2:22 PM UTC

gngeal wrote: post #89

tytso wrote: post #83

There are several different ways in which randomness is used in the kernel. One general class of randomness is things like randomizing the sequence numbers and port numbers of new network connections. If you can predict the result of this randomness, it becomes easier to carry out attacks such as hijacking a TCP connection. (Note that if the active attacker controls the path between the source and the destination, th…

If you are super paranoid, you'll need to find a hardware random generator which you've built yourself --- and hopefully you are competent enough to actually build a real HWRNG, and not something which is sampling 60 Hz hum (or 50 Hz hum if you are in Europe :-), and mix that into the entropy pool as well. What do you propose as a low cost solution? I've seen some interesting suggestions, such as having a small fish…

Post by amalcon » Sun, Jul 14, 2013, 3:10 PM UTC

gngeal wrote: post #89

tytso wrote: post #83

There are several different ways in which randomness is used in the kernel. One general class of randomness is things like randomizing the sequence numbers and port numbers of new network connections. If you can predict the result of this randomness, it becomes easier to carry out attacks such as hijacking a TCP connection. (Note that if the active attacker controls the path between the source and the destination, th…

If you are super paranoid, you'll need to find a hardware random generator which you've built yourself --- and hopefully you are competent enough to actually build a real HWRNG, and not something which is sampling 60 Hz hum (or 50 Hz hum if you are in Europe :-), and mix that into the entropy pool as well. What do you propose as a low cost solution? I've seen some interesting suggestions, such as having a small fish…

Post by tytso » Sun, Jul 14, 2013, 4:49 PM UTC

nullc wrote: post #94

raverbashing wrote: post #74

Earlier quoted context omitted.

Apparently, for some "security experts" it's damned if you do, damned if you don't If you don't use RdRand then you have few sources of "true" randomness, hence, your RNG is predictable, manipulable and you're an idiot and a 5 year old can break your crypto If you use RdRand then "blah blah blah this is opaque", hence, your RNG is predictable, manipulable and you're an idiot and a 5 year old can break your crypto Per…

Meh. Simply making the default pool larger would go a long way towards moving systems out of a desperate situation. With that done there would be a lot less reason to short circuit it and go RdRand only. No one is concerned about RdRand as a contributing source— with other genuine source of randomness RdRand isn't likely a back door once mixed in.

Post by raverbashing » Sun, Jul 14, 2013, 5:25 PM UTC

tytso wrote: post #95

nullc wrote: post #94

Earlier quoted context omitted.

Meh. Simply making the default pool larger would go a long way towards moving systems out of a desperate situation. With that done there would be a lot less reason to short circuit it and go RdRand only. No one is concerned about RdRand as a contributing source— with other genuine source of randomness RdRand isn't likely a back door once mixed in.

Making the pool larger isn't sufficient for embedded systems that don't have a lot of sources of entropy in the first place. Especially since very often the most critical secrets (such as the RSA keys for the certificates used by network printers, for example) are generated when the embedded system is first installed, where even if you have a larger pool, there isn't any opportunity to fill with the extremely limited…

Post by gngeal » Sun, Jul 14, 2013, 9:13 PM UTC

rational_indian wrote: post #98

gngeal wrote: post #89

Earlier quoted context omitted.

If you are super paranoid, you'll need to find a hardware random generator which you've built yourself --- and hopefully you are competent enough to actually build a real HWRNG, and not something which is sampling 60 Hz hum (or 50 Hz hum if you are in Europe :-), and mix that into the entropy pool as well. What do you propose as a low cost solution? I've seen some interesting suggestions, such as having a small fish…

I think a zener diode based solution will suffice in a pinch http://en.wikipedia.org/wiki/Noise_generator