News for hackers. Stuff that matters.

A comment on Milk Sad: Weak Entropy in libbitcoin (bc) seed generation. Parent comment

Re:Milk Sad: Weak Entropy in libbitcoin (bc) seed generation by aidenn0 on Tuesday August 08, 2023 @05:53PM (#37055955)
Would a CSPRNG be at all an improvement with only a 32 bit seed? Couldn't you still brute force it?
[ Parent | on HN ]
Re:Milk Sad: Weak Entropy in libbitcoin (bc) seed generation by ryanatdistrust on Tuesday August 08, 2023 @06:00PM (#37056028)
That is correct, you still have 2^32 permutations of possible values.
[ Parent | on HN ]
Re:Milk Sad: Weak Entropy in libbitcoin (bc) seed generation by marginalia_nu on Tuesday August 08, 2023 @06:47PM (#37056511)
Given it's seeded with system time, depending on the resolution, that may in practice be as low as tens of thousands of possible values (as in time(2) )
[ Parent | on HN ]
Re:Milk Sad: Weak Entropy in libbitcoin (bc) seed generation by ryanatdistrust on Tuesday August 08, 2023 @07:02PM (#37056603)
2^32 is still incredibly small for crypto and is inexcusable.
[ Parent | on HN ]
Re:Milk Sad: Weak Entropy in libbitcoin (bc) seed generation by nullc on Tuesday August 08, 2023 @07:11PM (#37056697)
A fact which was unambiguously well known to the authors prior to the report: https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2022...
[ Parent | on HN ]
Re:Milk Sad: Weak Entropy in libbitcoin (bc) seed generation by a-dub on Tuesday August 08, 2023 @07:20PM (#37056776)
i think the bigger problem is that the seed is easily guessed or found, so all the output can be regenerated.

so it's not even 32 bits of entropy, it's some tiny fraction of that. (system times for a few years interval)

[ Parent | on HN ]
Re:Milk Sad: Weak Entropy in libbitcoin (bc) seed generation by ryanatdistrust on Tuesday August 08, 2023 @09:46PM (#37057804)
As discussed elsethread, it used the lower bits of the time value, so while there is is a fraction of the 2^32 space due to precision loss in the OS time calculations, it is not as simple as "between when this software was released and now, in seconds".
[ Parent | on HN ]