Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Android RNG Weakness Renders Bitcoin Wallets Insecure

bitcoin.org

Post reply on HN
Print view View original

101–105 of 105 posts

Re: Android RNG Weakness Renders Bitcoin Wallets Insecure

#101

Post by tptacek »

tedunangst wrote: post #100
tptacek wrote: post #97

Earlier quoted context omitted.

So then what you should do is write a "libpcap for randomness" that uses the best-practices method of getting randomness from the OS CSPRNG. On Linux it'll be just a couple lines; on BSD it'll be a few more lines for the "atomicio" equivalent read, and on WINAPI it'd set up and call CryptGenRandom. There's value in having a uniform interface to all the different OS CSPRNGs. What I'm saying isn't valuable is duplicati…

How is OpenSSL RAND_bytes not that uniform interface?

OpenSSL provides its own CSPRNG. When that CSPRNG breaks, as it has in the past, no amount of careful validation of the OS CSPRNG helps you. The OpenSSL CSPRNG is thus a second single point of failure.

Re: Android RNG Weakness Renders Bitcoin Wallets Insecure

#102

Post by tptacek »

marshray wrote: post #86
tptacek wrote: post #85

Earlier quoted context omitted.

You see my point, right? A lot of your security already depends on urandom working. Everyone knows this, and a lot of effort has gone into validating the kernel random driver (there have been some pretty good systems security papers on it). Given that you already depend on urandom, all a new CSPRNG gets most developers is a second single point of failure.

I get your point and I agree it's at least not a wrong way to look at it. But you say "the kernel random driver" as if there were only one for a crypto app developer to worry about. We have already seen a huge number of bad keys generated. Is it that obvious at this point that kernel (and embedded system) developers are so much better at this than OpenSSL? Is it possible that you just tend to look at more broken libr…

It is true that we see a lot of broken randomness code, and it is also true that we pay a lot of attention to failures of different CSPRNGs, but my point of view on this is also influenced by things like the design paper Daniel Bernstein wrote for Nacl.

Re: Android RNG Weakness Renders Bitcoin Wallets Insecure

#103

Post by glurgh »

mydpy wrote: post #96
mydpy wrote: post #94

Can anyone reference me to an article that explores a technical analysis of how their random number generator was exploited? Did it not have full coverage (read: RANDU style error) or otherwise? http://www.pnas.org/content/61/1/25.full.pdf+html

Actually, I found it here. Pretty interesting issue, I recommend the read. I'll summarize the paper here: Java implementations primarily used on lightweight mobile platforms have a method called SecureRandom which generates pseudo random numbers for cryptographic operations. The integrated seed generator on some platforms provides a systematic means of determining the seed value and predicting seemingly secure output…

Yes but that's not the problem being reported.

Re: Android RNG Weakness Renders Bitcoin Wallets Insecure

#104

Post by marshray »

tptacek wrote: post #102
marshray wrote: post #86

Earlier quoted context omitted.

I get your point and I agree it's at least not a wrong way to look at it. But you say "the kernel random driver" as if there were only one for a crypto app developer to worry about. We have already seen a huge number of bad keys generated. Is it that obvious at this point that kernel (and embedded system) developers are so much better at this than OpenSSL? Is it possible that you just tend to look at more broken libr…

It is true that we see a lot of broken randomness code, and it is also true that we pay a lot of attention to failures of different CSPRNGs, but my point of view on this is also influenced by things like the design paper Daniel Bernstein wrote for Nacl.

I'll wager your team has reviewed more crypto code, and more recently, than DJB.

Meh, this conversation needed to be over

      do random_beverage(); while (self->is_conscious());

Re: Android RNG Weakness Renders Bitcoin Wallets Insecure

#105

Post by tptacek »

marshray wrote: post #104
tptacek wrote: post #102

Earlier quoted context omitted.

It is true that we see a lot of broken randomness code, and it is also true that we pay a lot of attention to failures of different CSPRNGs, but my point of view on this is also influenced by things like the design paper Daniel Bernstein wrote for Nacl.

I'll wager your team has reviewed more crypto code, and more recently, than DJB. Meh, this conversation needed to be over do random_beverage(); while (self->is_conscious());

Tell you what: I will ask DJB tonight and see what he says.
Post reply on HN