[dsfjdssdfsd] Remove ref to DSS RNG

[Dan Brown <[e-mail]>]

Hi,

 

I think that the RFC 4086 sequel should drop the reference in its Section
7.2.3 to DSS RNG, or deprecate it.

 

The main reason, as I vaguely recall, is that it suffers from some form of
backtracking attack (found by somebody other than me).  Hence X9.62-2005
dropped this RNG..

 

I wonder if the following weak attack is the attack I'm trying to remember:

 

An adversary who sees the latest output X_j and compromises the current
state XKEY_(j+1) should, ideally, not be able to distinguish X_j from a
uniformly random bit string.  The idea is that current secret state reveals
nothing about past states.

 

But in the DSS RNG, an adversary can easily confirm the match by testing
that

 

X_j == G(t, XKEY_(j+1) - 1 - X_j) 

 

Assuming that (optional user input) == 0.

 

Hmm, maybe I'm wrong and just missing something obvious.  

 

I think newer DRBGs, e.g. in X9.82-3 and SP 800-90A, try to resist such
attacks.

 

Best regards,

 


Daniel Brown


Research In Motion Limited