Re: [TLS] RNG vs. PRNG

[Nicolas Williams <[e-mail]>]

On Wed, May 05, 2010 at 05:02:37PM -0500, Marsh Ray wrote:
> On 5/5/2010 1:28 AM, Nicolas Williams wrote:
> > I'm not sure what the point of this sub-thread is.
> 
> The currently language in the spec is broken and misleading to the point
> that people (implementers) are unclear about the requirements for
> various protocol structures.
> 
> It's entirely within the scope of the spec to specify what properties of
> various structures (e.g., premaster secret) are required for security.
> The current specs do talk about it, but people seem to come away with
> different meanings because the terminology is inconsistent.
> 
> In the case of client_hello.random and server_hello.random, I believe
> that even though they are sent in-the-clear they need to be
> crypto-quality unpredictable (and of course reveal no information about
> any secret internal state).

This is really the province of RFC4086/BCP0106.  TLS has no business
having different entropy requirements than other security protocols (set
aside for now the fact that having weak entropy sources will have
varying impact depending on the use).  As such there are better fora
than the TLS WG for this discussion.

In any case, we've not exactly been debating what properties we need for
*RNGs for TLS.  We've instead ratholed into a "true RNGs are better"
"are not" situation.

> > Also, none of this is new; the subject has been
> > exhaustively treated before, thus we're just annoying uninterested TLS
> > WG list subscribers and wasting our own time.
> 
> I agree that some of this is a tiny bit annoying, it bugs me that
> everyone isn't on the same page with the terminology. I don't understand

Welcome to the world of... well, this world.

> why anyone would confuse a raw thermal noise source with a
> well-constructed RNG (e.g., a healthy /dev/random), with a deterministic
> PRNG (e.g. TLS's PRF), and so on.

We don't have good, standard terminology.  Some people don't mean
PRNG-seeded-with-static-seed-and-maybe-a-counter when they speak of
PRNGs, but others interpret "PRNG" to mean just that and then treat the
first as idiots.  Trouble ensues.  I agree, we need common terminology.

> Still, it seems pretty important that the next revision of the spec (or
> some other IETF document) conveys the requirements clearly enough that
> insecure implementations don't get shipped.

I don't agree.  The next revision, like the current one, should
reference RFC4086, though we might want a normaitive reference instead
of an informative one.  We might also want a standard, rather than just
a BCP, on entropy.  Also, BCP0106 should have a glossary.

Nico
--