[lkml]   [2007]   [Dec]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: /dev/urandom uses uninit bytes, leaks user data
    On Tue, Dec 18, 2007 at 02:39:00PM +1030, David Newall wrote:
    > Thus, the entropy saved at shutdown can be known at boot-time. (You can
    > examine the saved entropy on disk.)

    If you can examine the saved entropy on disk, you can also introduce a
    trojan horse kernel that logs all keystrokes and all generated entropy
    to the FBI carnivore server --- you can replace the gpg binary with
    one which ships copies of the session keys to the CIA --- and you can
    replace the freeswan server with one which generates emphermal keys by
    encrypting the current timestamp with a key known only by the NSA. So
    if the attacker has access to your disk between shutdown and boot up,
    you are *done*. /dev/random is the least of your worries.

    Really, why is it that people are so enamored about proposing these
    totally bogus scenarios? Yes, if you have direct physical access to
    your machine, you can compromise it. But there are far easier ways
    that such a vulnerability can be exploited, rather than making it easy
    to carry out an cryptoanalytic attack on /dev/random.

    (And yes, after using the saved state to load the entropy at
    boot-time, the saved state file is overwritten, and if you're
    paranoid, you can scrub the disk after it is read and mixed into the
    entropy pool. And yes, the saved state is *not* the entropy pool used
    during the previous boot, but entropy extracted using SHA-1 based

    >> If you have a server, the best thing you can do is use a hardware
    >> random number generator, if it exists. Fortunately a number of
    >> hardware platforms, such as IBM blades and Thinkpads, come with TPM
    >> modules that include hardware RNG's. That's ultimately the best way
    >> to solve these issues.
    > Just how random are they? Do they turn out to be quite predictable if
    > you're IBM?

    They use a noise diode, so they are as good as any other hardware
    random number generator. Of course, you ultimately have to trust the
    supplier of your hardware not to do something screwy, and Thinkpads
    are now made by Lenovo, which has caused some US Government types to
    get paranoid --- but that's why the best way to do things is to get
    entropy from as many places as possible, and mix it all into
    /dev/random. If any one of them is unknown to the attacker, he's stuck.

    And if you are sufficiently paranoid, you obviously can't use
    commodity hardware, and how do you know that some time along time ago,
    someone snuck in a evil secret code into the C compiler that was
    designed to survive a bootstrap process[1]? And how do you know that
    your keyboard controller hasn't been gimmicked to record your key
    strokes and then send them out by adding jitter that can be read by an
    attacker looking at the timing of your ssh packets[2]?

    But seriously, if you are that paranoid, better build your hardware
    from scratch, and then hand assemble your compiler, and then do a
    line-by-line audit of all of your source code. It's going to be the
    only way to be sure....

    - Ted

    [1] Ken Thompson, Reflections on Trusting Trust.

    [2] Gaurav Shah, Andres Molina and Matt Blaze, Keyboards and Covert Channels.

     \ /
      Last update: 2007-12-18 05:27    [W:0.024 / U:36.616 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site