Re: [TLS] New drafts: adding input to the TLS master secret

[Bill Frantz <[e-mail]>]

[e-mail] (Marsh Ray) on Wednesday, February 10, 2010 wrote:

>I'm a fan of continual seeding as entropy becomes available.

However, be aware of "State Compromise Extension Attacks"*. If you dribble
in new entropy a few bits at a time to a compromised PRNG, and also expose
outputs of the PRNG, an attacker can try all possible values for the new
entropy and compare them with the known output continuing the compromise of
the PRNG. If instead, you save the new entropy until a large number of
unguessable bits are available, you foil this attack.

I belong to the school that says, "Give me enough unguessable bits (e.g
256), and a way to keep them secret, I can be secure to the heat death of
the universe." I like continually reseeding in large blocks because these
two requirements may not be possible.

Cheers - Bill

* John Kelsey, Bruce Schneier, David Wagner, Chris Hall: “Cryptanalytic
Attacks on Pseudorandom Number Generators”
<http://www.schneier.com/paper-prngs.pdf>

-----------------------------------------------------------------------
Bill Frantz        | gets() remains as a monument | Periwinkle
[phone]      | to C's continuing support of | 16345 Englewood Ave
www.pwpconsult.com | buffer overruns.             | Los Gatos, CA 95032