“RNG broken for last 4 months”

Re:“RNG broken for last 4 months” by fixermark on Tuesday February 17, 2015 @01:58PM (#9064220)

Statistic testing seems like it ought to work. However, I believe there's also the issue of actual uses of the RNG; it's not enough to test the kernel implementation, one must also test that libraries are using the implementation correctly (i.e. not using constant or completely-predictable seed), etc.

So it's not a trivial problem, because (among other reasons) nondeterministic, statistical testing is not well-understood in the testing culture.

[ Parent | on HN ]

Re:“RNG broken for last 4 months” by tedunangst on Tuesday February 17, 2015 @07:03PM (#9066105)

Further complication: many RNGs will produce output as a function of their seed state (e.g., rc4 or chacha20). That output will look really good, even with weak seeds. You'll have a hard time detecting that two chacha20 streams were seeded with gettimeofday() for instance, unless you happen to check the exact time used.

[ Parent | on HN ]