Re: [Dtls-iot] Reference to Heninger Paper

[Hannes Tschofenig <[e-mail]>]

Hi Stephen,

I discussed the issue with Thomas, my co-author, and we know understand
the misunderstanding. We thought it would be easier to remove the
reference to the Heninger paper.


Here is the new text:

---------------------------------

14.  Random Number Generation

   The TLS/DTLS protocol requires random numbers to be available during
   the protocol run.  For example, during the ClientHello and the
   ServerHello exchange the client and the server exchange random
   numbers.  Also, the use of the Diffie-Hellman exchange requires
   random numbers during the key pair generation.

   It is important to note that sources contributing to the randomness
   pool on laptops, or desktop PCs are not available on many IoT device,
   such as mouse movement, timing of keystrokes, air turbulence on the
   movement of hard drive heads, etc.  Other sources have to be found or
   dedicated hardware has to be added.

   Lacking sources of randomness in an embedded system may lead to the
   same keys generated again and again.

---------------------------------

Ciao
Hannes


On 07/15/2015 01:26 PM, Stephen Farrell wrote:
> 
> Hiya,
> 
> On 15/07/15 12:15, Hannes Tschofenig wrote:
>> Stephen wrote:
>>
>> (7) 14: Doesn't [Heninger] really cause many devices to use one RSA
>> prime factor? That's not the same as "same keys again and again" and in
>> any case you're not recommending RSA keys on challenged nodes here.
>> Shouldn't you do the analysis of the impact of a dodgy PRNG on
>> populations of devices that follow these profiles and not something else?
>>
>>
>> Heninger did an analysis of the deploy infrastructure of that time and
>> RSA is in widespread use. Hence, her analysis focuses on the problems
>> with RSA keys.
>>
>> However, her observations are general in the sense that a non-existent
>> or bad random number generator will lead to output that is predictable
>> or the same with a number of devices. This is essentially what I write.
>>
>> Copy-and-paste from the text:
>>
>> ---
>>    Special care has to
>>    be taken when generating random numbers in embedded systems as many
>>    entropy sources available on desktop operating systems or mobile
>>    devices might be missing, as described in [Heninger].  Consequently,
>>    if not enough time is given during system start time to fill the
>>    entropy pool then the output might be predictable and repeatable, for
>>    example leading to the same keys generated again and again.
> 
> It's that last bit that's wrong though. With RSA it was the same first
> prime being "found" with non-negligible probability. As far as we know
> all the same-key cases are because the private key was installed. And
> even with e.g. ECDSA privates of randoms-used-in-signing, if one can
> predict some but not all bits, one still wins the game I think.
> 
> So s/same keys/weak keys/ would be ok and the reason this is notable
> is that I think there are likely developers out there who'd think that
> they must be fine if the public key values are unique. [Heninger]
> shows us that's not the case.
> 
> Even better than s/same keys/weak keys/ would be to explain a bit
> more about [Heninger] - say a para like the above.
> 
> Cheers,
> S.
> 
> 
> 
>> ---
>>
>>
>>
>> _______________________________________________
>> dtls-iot mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/dtls-iot
>>
> 
> 
> 
> _______________________________________________
> dtls-iot mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/dtls-iot
>