Re: [Dtls-iot] Reference to Heninger Paper

[Stephen Farrell <[e-mail]>]

Hiya,

On 15/07/15 12:15, Hannes Tschofenig wrote:
> Stephen wrote:
> 
> (7) 14: Doesn't [Heninger] really cause many devices to use one RSA
> prime factor? That's not the same as "same keys again and again" and in
> any case you're not recommending RSA keys on challenged nodes here.
> Shouldn't you do the analysis of the impact of a dodgy PRNG on
> populations of devices that follow these profiles and not something else?
> 
> 
> Heninger did an analysis of the deploy infrastructure of that time and
> RSA is in widespread use. Hence, her analysis focuses on the problems
> with RSA keys.
> 
> However, her observations are general in the sense that a non-existent
> or bad random number generator will lead to output that is predictable
> or the same with a number of devices. This is essentially what I write.
> 
> Copy-and-paste from the text:
> 
> ---
>    Special care has to
>    be taken when generating random numbers in embedded systems as many
>    entropy sources available on desktop operating systems or mobile
>    devices might be missing, as described in [Heninger].  Consequently,
>    if not enough time is given during system start time to fill the
>    entropy pool then the output might be predictable and repeatable, for
>    example leading to the same keys generated again and again.

It's that last bit that's wrong though. With RSA it was the same first
prime being "found" with non-negligible probability. As far as we know
all the same-key cases are because the private key was installed. And
even with e.g. ECDSA privates of randoms-used-in-signing, if one can
predict some but not all bits, one still wins the game I think.

So s/same keys/weak keys/ would be ok and the reason this is notable
is that I think there are likely developers out there who'd think that
they must be fine if the public key values are unique. [Heninger]
shows us that's not the case.

Even better than s/same keys/weak keys/ would be to explain a bit
more about [Heninger] - say a para like the above.

Cheers,
S.



> ---
> 
> 
> 
> _______________________________________________
> dtls-iot mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/dtls-iot
>