Wow. So not very?
Pretty much.
How secure is Linux's random number generator?
31–40 of 100 posts
Re: How secure is Linux's random number generator?
#32Just because something is closed source doesn't mean it's insecure. RdRand meets various standards for RNGs and the dieharder tests don't show anything of concern. While you can't be 100 percent sure of the reliability of RdRand because you can't audit it, I feel safe trusting it for all but the most critical of applications. Here's a blog post describing testing RdRand with dieharder: http://smackerelofopinion.blogs…
"Just because something is closed source doesn't mean it's insecure"
Yes it does. Closed source, to the extent it impairs audits, does mean something is insecure.
It does not prove that the software is backdoored, otherwise compromised, or defective in any way - if that is what you meant, you're correct. But security means not only absence of these conditions, but also that you can verify that these conditions are absent.
Security is relative. "Secure" is a short form of "high enough confidence". There can be a rational basis for high or low confidence, based on various factors, including testing and likely motives of the parties. Closed source itself is a bad factor. Collaboration with the USG is a very bad factor.
Re: How secure is Linux's random number generator?
#33Earlier quoted context omitted.
And even Linus talks about the NSA in that same thread a little lower: https://lkml.org/lkml/2011/7/30/116
And the next email where Ted says that the NSA are one of the good guys... Yeah, not so much.
For anyone wondering, he literally does not say that.
He says if you're in the government they're one of the good guys, if you're anyone else you want to mix the results of their RNG with some other source.
Which is apparently exactly what this patch does.
Re: How secure is Linux's random number generator?
#34Am I the only guy who can't figure out how to navigate mailing lists archives? These things are internet hell.
I have a conjecture that I believe explains the high concentration of suck in almost all mailing list archive software.
Let R = { people who read mailing list archives }
Let D = { people who design and implement mailing list archives }
My conjecture: R ∩ D = ∅.
Re: How secure is Linux's random number generator?
#35Earlier quoted context omitted.
Ironically, it's particularly vis a vis cryptographic random number generation where we can most easily show open source cryptography failing its users; Debian fatally broke the OpenSSL CSPRNG so badly that attackers could remotely brute force SSH keys.
Not defending the debain change but openssl code structure / readability is far from great, the only packages I would put behind openssl is libxml2, glib and glibc.
Weird. I find glib quite readable: https://git.gnome.org/browse/glib/tree/
Re: How secure is Linux's random number generator?
#36A longer excerpt from the same email list:
Re: How secure is Linux's random number generator?
#37And here is the mailing list thread that the author refers to: https://lkml.org/lkml/2011/7/29/366
There was a lot more follow-up later, see e.g. https://lkml.org/lkml/2012/7/5/422
The important commit here is:
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.g...
Excerpted:
Change get_random_bytes() to not use the HW RNG, even if it is avaiable.
The reason for this is that the hw random number generator is fast (if it is present), but it requires that we trust the hardware manufacturer to have not put in a back door. (For example, an increasing counter encrypted by an AES key known to the NSA.)
It's unlikely that Intel (for example) was paid off by the US Government to do this, but it's impossible for them to prove otherwise --- especially since Bull Mountain is documented to use AES as a whitener. Hence, the output of an evil, trojan-horse version of RDRAND is statistically indistinguishable from an RDRAND implemented to the specifications claimed by Intel. Short of using a tunnelling electronic microscope to reverse engineer an Ivy Bridge chip and disassembling and analyzing the CPU microcode, there's no way for us to tell for sure.
Re: How secure is Linux's random number generator?
#38So this is logic that more or less rules out all hardware encryption, including HSMs, right?
Re: How secure is Linux's random number generator?
#39this is my favourite conspiracy theory that the CPUs are backdoored. just assign a bunch of registers with some special values and execute a specific instruction and the CPU will drop all memory protection. take something like google's NACL or a javascript JIT where you have enough control over the registers and you have a permanent browser exploit.
Re: How secure is Linux's random number generator?
#40And here is the mailing list thread that the author refers to: https://lkml.org/lkml/2011/7/29/366
There was a lot more follow-up later, see e.g. https://lkml.org/lkml/2012/7/5/422 The important commit here is: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.g... Excerpted: Change get_random_bytes() to not use the HW RNG, even if it is avaiable. The reason for this is that the hw random number generator is fast (if it is present), but it requires that we trust the hardware manufacturer to have not put i…
[deleted]