Re:Attack of the week: DUHK
by jorangreef on Tuesday October 24, 2017 @09:12AM
(#15541243)
"hashing the output of a RNG is a bad countermeasure against a possibly-bad RNG"
Why? I would think it's a fair suggestion for defense in depth, especially if you need to expose the result as a nonce, and you don't want to leak anything else unwittingly. It's also a good idea if you're not sure whether the entropy is evenly distributed, which is where something like HKDF would also want to hash the entropy source.
"using protocols that don't require entropy"
That rules out most secure protocol handshakes.
You could just use a better RNG in the first place.
Re:Attack of the week: DUHK
by jorangreef on Tuesday October 24, 2017 @09:46AM
(#15541448)
The point is that it's not XOR. You can use a better RNG and also hash entropy before exposing it as a nonce. Why throw out defense in depth?
One abstraction level up, hashing the output of a RNG is a bad countermeasure against a possibly-bad RNG. Good countermeasures including mixing the outputs of multiple RNGs and using protocols that don't require entropy.