Re: [dsfjdssdfsd] What has gone wrong with RNGs in practice

[Theodore Ts'o <[e-mail]>]

On Fri, Nov 15, 2013 at 11:36:14AM -0500, Nick Mathewson wrote:
> CC. Theoretically unsound pool constructions
> 
> See for example the recent paper on the Linux /dev/*random devices'
> constructions [10].

CC is a bit vague, and is redundant with AA, BB, and EE in your list.

The assertion made in [10] is that an attacker who can control all of
the entropy inputs in such a way that defeats the entropy estimator
(which is EE), could result in a failure of guarantees such as BB
(recovery after compromised state).

Whether or not an attacker could control all entropy inputs in such as
way that it could defeat the entropy estimator was not actually shown
in [10], and I'm not entirely sure that insisting on a theoretical
model which requires that a design should be robust against by
arbitrary control of the entropy sources (as opposed to auditing the
entropy sources actually *used* by the RNG) is a all that useful ---
but that's aside from the point I'm trying to make here, which is if
you're going to have a list of potential RNG failures, they should be
a specific set of things that you can look for, and not something
vague and overarching such as "bad design of the RNG pools".

Cheers,

							- Ted