[saag] Re: [dispatch] FW: New Version Notification for draft-rsalz-4086bis-00.txt

[Paul Wouters <[e-mail]>]

On Fri, Oct 9, 2026 at 8:09 AM Stephen Farrell <stephen.farrell=
[e-mail]> wrote:

>
>
> The fact that we have strong evidence that a significant
> player (NSA) made serious efforts to bork a PRNG is not
> something to forget, and does lead to implementation
> changes, e.g. as recommended in RFC8446 to use different
> streams of randomness for public and non-public values.
>

Agreed here.


> (The more recent endless ml-kem discussion shows up yet
> another potential stream one might want separated, being
> values that are not sent in clear, but that an active
> prober/attacker could re-construct.)
>

Sure, as long as we keep talking about streams and not about
just adding a hashing step in front of any random bytes requirement
as was suggested in those threads, as it was shown to be completely
pointless.


> So yes this all warrants discussion in any 4086bis draft
> and not including that would do a serious dis-service to
> readers as to what we've learned since 4086 was done.
>

I agree we should mention the dangers of building your own random number
algorithm or PRNG. I would also hope we mention using PRNGs that use
entropy pools, and not pulling straight from a HW RNG like RDRAND which is
extremely risky if that function turned out backdoored or weak or like in
the case of AMD bugs twice, so broken it just returns zeros [1].

Paul
[1]
https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7055.html