lkml.org 
[lkml]   [2022]   [May]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: is "premature next" a real world rng concern, or just an academic exercise?
Hi!

> >
> > Thank you for starting this fascinating discussion. I generally agree with everything Jason said. In particular, I am not
> > 100% convinced that the extra cost of the premature next defense is justified.(Although Windows and MacOS are adamant it is
> > worth it :).)
> >

Dunno, how big is cost of "premature next" defenses? I believe all you
need to do is to reseed in batches, and that does not seem costly at
runtime, and does not have high cost in kernel .text.

> > But let me give some meta points to at least convince you this is not as obvious as Jason makes it sound.
> >
> > 1) Attacking RNGs in any model is really hard. Heck, everybody knew for years that /dev/random is a mess
> > (and we published it formally in 2013, although this was folklore knowledge), but in all these years nobody
> > (even Nadya's group :)) managed to find a practical attack. So just because the attack seems far-fetched, I do not think we should
> > lower our standards and do ugly stuff. Otherwise, just leave
> >/dev/random the way it was before Jason started his awesome work.

Well, practical attacks may be hard, but when they happen... that's
bad. We had weak keys generated by debian, we have various devices
that with deterministic rngs...

Best regards,
Pavel
--
People of Russia, stop Putin before his war on Ukraine escalates.
[unhandled content-type:application/pgp-signature]
\
 
 \ /
  Last update: 2022-05-11 22:47    [W:0.162 / U:0.068 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site