[lkml]   [2001]   [Aug]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRE: /dev/random in 2.4.6

    > That's not the only attack, actually. The much simpler attack pathis
    > for an attack to **observe** the network traffic to such a precise
    > extent as to be able to guess what the entropy numbers are that are
    > going into the pool. (Think: FBI's Carnivore).
    > The one saving grace here is that in order to really do this well, the
    > attacker would need to be sitting on the local area network to get the
    > best and most precise timing numbers. You can argue that this is
    > still a theoretical attack; but it's not quite so difficult as saying
    > that the attacker has to "control" the network traffic.
    > - Ted

    This is a non-issue providing the entropy pool code correctly estimates the
    amount of entropy. The Linux entropy code is written so that there is no
    harm from putting fully known or partially known numbers into the pool
    provided that the pool does not overestimate the amount of entropy in those

    Even if you could perfectly time the packets on the LAN, you still could
    not tell the clock skew between the clock on the LAN card and the TSC. There
    would still be unknowns involving how long it would take for the interrupt
    to be acknowledged and the entropy gathering code to get to the CPU. These
    unknowns still contain real entropy that there is no known way an attacker
    could know.


    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    More majordomo info at
    Please read the FAQ at

     \ /
      Last update: 2005-03-22 12:57    [W:7.973 / U:0.540 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site