News for hackers. Stuff that matters.

A comment on Cracking random number generators (xoroshiro128+). Parent comment

Re:Cracking random number generators (xoroshiro128+) by DiThi on Tuesday August 22, 2017 @09:44AM (#15072273)
Strong crypto RNGs use PRNGs but combines sources of entropy, environmental noise from devices such as the number of CPU cycles between user keystrokes. T̶h̶a̶t̶'̶s̶ ̶t̶h̶e̶ ̶d̶i̶f̶f̶e̶r̶e̶n̶c̶e̶ ̶b̶e̶t̶w̶e̶e̶n̶ ̶/̶d̶e̶v̶/̶r̶a̶n̶d̶o̶m̶ ̶a̶n̶d̶ ̶/̶d̶e̶v̶/̶u̶r̶a̶n̶d̶o̶m̶ ̶i̶n̶ ̶L̶i̶n̶u̶x̶.̶
[ Parent | on HN ]
Re:Cracking random number generators (xoroshiro128+) by yorwba on Tuesday August 22, 2017 @12:57PM (#15074238)
I was wondering how you managed to strike out part of your comment when https://news.ycombinator.com/formatdoc doesn't mention any markup for that, but then I realized you were using the "combining long stroke overlay" Unicode character ( ̶). Nice trick.
[ Parent | on HN ]
Re:Cracking random number generators (xoroshiro128+) by bradleyjg on Tuesday August 22, 2017 @09:56AM (#15072405)
After an initial seeding the only thing additional entropy adds is limiting the damage from a compromise of the internal state of the PRNG. And if the OS's internal PRNG state is compromised, what makes you think your process isn't?
[ Parent | on HN ]
Re:Cracking random number generators (xoroshiro128+) by DiThi on Tuesday August 22, 2017 @08:37PM (#15077561)
What if you're using several PRNGs XORed together and reseeded frequently?
[ Parent | on HN ]
Re:Cracking random number generators (xoroshiro128+) by bradleyjg on Wednesday August 23, 2017 @02:09PM (#15083719)
Why would you want to do that?
[ Parent | on HN ]
Re:Cracking random number generators (xoroshiro128+) by DiThi on Wednesday August 23, 2017 @06:24PM (#15085721)
That would make much more difficult (if not impossible) to guess the internal state of all RNGs.
[ Parent | on HN ]
Re:Cracking random number generators (xoroshiro128+) by bradleyjg on Wednesday August 23, 2017 @06:36PM (#15085796)
You can't guess the internal state of a CSPRNG based on the output. That's what makes it CS. The only way to get the internal state is to break the OS protection and look at the memory directly. And if the attacker can do that, then they can do it for the multiple PRNG version too.
[ Parent | on HN ]
Re:Cracking random number generators (xoroshiro128+) by DiThi on Thursday August 24, 2017 @10:18AM (#15090280)
I misunderstood the context in your replies. We were kind of talking about different topics.
[ Parent | on HN ]
Re:Cracking random number generators (xoroshiro128+) by Tomte on Tuesday August 22, 2017 @09:50AM (#15072338)
No, that difference (between /dev/random and /dev/urandom) does not exist, has never existed and will never exist. Please don't spread those myths.
[ Parent | on HN ]
Re:Cracking random number generators (xoroshiro128+) by andruby on Tuesday August 22, 2017 @09:55AM (#15072392)
As I am uninformed on the subject, could you tell me the difference between /dev/random and /dev/urandom?
[ Parent | on HN ]
Re:Cracking random number generators (xoroshiro128+) by Tomte on Tuesday August 22, 2017 @10:07AM (#15072519)
You're right, that was too short and thus too harsh. Please accept my apologies.

So a short roundup:

/dev/random and /dev/urandom used to be exactly the same (on Linux), except that /dev/random did some voodoo "entropy estimation" that the Linux kernel guys are totally in love with, but everyone else doesn't trust anyway. Even if there was a plausible model how to estimate entropy, which there isn't.

In the meantime things have changed quite a bit. But the main thing to know is the same: /dev/urandom is the device you want to use for cryptographic randomness. /dev/random is an oddity that will be there forever because Linux takes backwards compatibility (for user space) extremely seriously.

(On other Unixoid platforms you also want /dev/urandom)

If you can use syscalls and don't need a device, use getrandom(2) over /dev/urandom. It's better.

Oh, and please note that the Linux man pages have been updated! They now state clearly that /dev/urandom is suitable for cryptographic use. Of course, lots of old man pages floating around on the web.

[ Parent | on HN ]
Re:Cracking random number generators (xoroshiro128+) by filleokus on Tuesday August 22, 2017 @09:57AM (#15072412)
Quite a long read, but I think it explains the situation quite well: https://www.2uo.de/myths-about-urandom/
[ Parent | on HN ]
Re:Cracking random number generators (xoroshiro128+) by Tomte on Tuesday August 22, 2017 @10:03AM (#15072473)
Unfortunately, the article isn't in the best shape right now.

Back when it was written, things were clear: random and urandom are the same. Then came getrandom as a distraction. Now urandom is based on chacha. So it's different (but not worse – still, harder to explain).

The article's structure couldn't easily accomodate those changes, and time was and is in short supply, and so it's not wrong, but much less forceful and clear than it used to be. I hope it shapes up soon, but don't promise anything!

Still, I don't know a more up-to-date article. Maybe Thomas Pornin has something newer on StackOverflow?

[ Parent | on HN ]
Re:Cracking random number generators (xoroshiro128+) by snakeanus on Tuesday August 22, 2017 @10:06AM (#15072503)
> Now urandom is based on chacha

Did Linux follow the example set by OpenBSD?

[ Parent | on HN ]
Re:Cracking random number generators (xoroshiro128+) by Tomte on Tuesday August 22, 2017 @10:08AM (#15072532)
I think so, yes. getrandom(2) is also an OpenBSD thing (getentropy), but of course they had to rename it and add a few options...
[ Parent | on HN ]
Re:Cracking random number generators (xoroshiro128+) by snakeanus on Tuesday August 22, 2017 @10:02AM (#15072468)
Also an interesting and related article https://sockpuppet.org/blog/2014/02/25/safely-generate-rando...
[ Parent | on HN ]
Re:Cracking random number generators (xoroshiro128+) by DiThi on Tuesday August 22, 2017 @11:09AM (#15073131)
But there IS a difference. You should correct me by saying "both use entropy sources but /dev/random blocks (or used to block) unnecessarily when the kernel considers there's not enough entropy".

By your answers I don't know if still blocks or not.

[ Parent | on HN ]
Re:Cracking random number generators (xoroshiro128+) by csomar on Tuesday August 22, 2017 @09:57AM (#15072423)
Unless Quantum Uncertainty holds true, and your RNG uses Quantum randomness then all RNG are pseudo.
[ Parent | on HN ]