From: Valdis.Kletnieks@vt.edu Subject: Re: [PATCH] random: add blocking facility to urandom Date: Sat, 10 Sep 2011 22:05:46 -0400 Message-ID: <118704.1315706746@turing-police.cc.vt.edu> References: <1314974248-1511-1-git-send-email-jarod@redhat.com> <1315464117.11199.51.camel@vespa.frost.loc> <20110908125234.GD13657@hmsreliant.think-freely.org> <201109080911.12921.sgrubb@redhat.com> Mime-Version: 1.0 Content-Type: multipart/signed; boundary="==_Exmh_1315706745_28234P"; micalg=pgp-sha1; protocol="application/pgp-signature" Content-Transfer-Encoding: 7bit Cc: Steve Grubb , Neil Horman , Tomas Mraz , Sasha Levin , "Ted Ts'o" , Jarod Wilson , linux-crypto@vger.kernel.org, Matt Mackall , Herbert Xu , Stephan Mueller , lkml To: Sandy Harris Return-path: Received: from lennier.cc.vt.edu ([198.82.162.213]:45508 "EHLO lennier.cc.vt.edu" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1758682Ab1IKCGD (ORCPT ); Sat, 10 Sep 2011 22:06:03 -0400 In-Reply-To: Your message of "Fri, 09 Sep 2011 10:21:13 +0800." Sender: linux-crypto-owner@vger.kernel.org List-ID: --==_Exmh_1315706745_28234P Content-Type: text/plain; charset=us-ascii On Fri, 09 Sep 2011 10:21:13 +0800, Sandy Harris said: > Barring a complete failure of SHA-1, an enemy who wants to > infer the state from outputs needs astronomically large amounts > of both data and effort. So let me get this straight - the movie-plot attack we're defending against is somebody readin literally gigabytes to terabytes (though I suspect realistic attacks will require peta/exabytes) of data from /dev/urandom, then performing all the data reduction needed to infer the state of enough of the entropy pool to infer all 160 bits of SHA-1 when only 80 bits are output... *and* doing it all without taking *any* action that adds any entropy to the pool, and *also* ensuring that no other programs add any entropy via their actions before the reading and data reduction completes. (Hint - if the attacker can do this, you're already pwned and have bigger problems) /me thinks RedHat needs to start insisting on random drug testing for their security experts at BSI. EIther that, or force BSI to share the really good stuff they've been smoking, or they need to learn how huge a number 2^160 *really* is.... --==_Exmh_1315706745_28234P Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Exmh version 2.5 07/13/2001 iD8DBQFObBd5cC3lWbTT17ARAiJDAKCfrzp7udA1haRF+OhRfyrjwLPcFwCfaI7M ObCuxyAWv2Ra4E0LvLriDTM= =4CR4 -----END PGP SIGNATURE----- --==_Exmh_1315706745_28234P--