[lkml]   [2007]   [Dec]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: /dev/urandom uses uninit bytes, leaks user data
Andrew Lutomirski wrote:
> No, it's there, and if there's little enough entropy around it can be
> recovered by brute force.

A little entropy is enough to prevent a brute force attack. You would
have to have ZERO entropy after a cold boot so the attacker would know
exactly the contents of the pool, AND know that one and ONLY one other
task has read from /dev/urandom, AND exactly what time that task did so,
AND how many bytes it read. Only then could the attacker read from
urandom and based on those bytes and the previous known pool state,
brute force the 3 bytes that came from some unknown location in the
other task's memory.

>>> Step 1: Boot a system without a usable entropy source.
>>> Step 2: add some (predictable) "entropy" from userspace which isn't a
>>> multiple of 4, so up to three extra bytes get added.
>>> Step 3: Read a few bytes of /dev/random and send them over the network.
>> Only root can do 1 and 2, at which point, it's already game over.
> Again, no. Root could do this accidentally. Step 1 happens all the
> time (see the comments on non-unique UUIDs). Step 2 just requires a

It does not happen all the time. It happens on a system that has just
been cold booted from read only distribution media with a broken cmos
clock, no user keyboard interaction, and no hardware rng and that's it.
Every other system is going to have some entropy from the last boot at

 \ /
  Last update: 2007-12-26 19:33    [W:0.089 / U:5.436 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site