/dev/random and virtual systems

Post by cpeterso » Mon, May 30, 2011, 12:01 AM UTC

ScottBurson wrote: post #6

In a previous job I worked for a company whose product needed some entropy on startup. It originally read from /dev/random. But then one of our customers reported that the product was hanging on startup, just after installation. It turned out that they had installed it into a freshly built VM (not a cloned one, I guess) and the read from /dev/random was waiting to accumulate enough entropy to return. (We changed it t…

For servers and VMs without much internal entropy, they could use a random number server. On boot, they could pull random seed data from a web service like random.org or by hashing Google News headlines.

Post by marshray » Mon, May 30, 2011, 2:23 AM UTC

tptacek wrote: post #21

AretNCarlsen wrote: post #19

Earlier quoted context omitted.

I'm coming from a background in massively parallel computing and financial services, both of which are heavy on security. Nonetheless, and even though I have been running cryptographically active instances on Amazon and Rackspace for a long time, I had honestly never thought about the RNG source on VMs. That is my own failure, of course. I wonder, though, whether everyone else knew about the VM RNG issue, or if only…

You did not miss the memo. Crypto on virtualized cloud platforms isn't trustworthy. But it's a grade of untrustworthy several steps higher than "exploitable SQL injection", so people don't think about it, talk about it, or take it seriously. The poll, though, is unnecessary and I flagged it. Meanwhile, you brought up: Robert Brown's dieharder: http://www.phy.duke.edu/~rgb/General/dieharder.php NIST Statistical Test S…

It is very easy for an uncorrelated stream of bits to be terribly insecure: they simply have to be seeded from the same source.

Case in point: The b0rked Debian OpenSSL RNG would certainly pass any statistical tests. But it still turned out to have only something on the order of 32767 unique sequences, i.e., 15 bits of entropy.

Re: /dev/random and virtual systems

Re: /dev/random and virtual systems