I gotta say, the combine subtlety of this vulnerability is impressive: - There is a config flag, which may or may not have a valid use. I'm not a networker or

I gotta say, the combine subtlety of this vulnerability is impressive: - There is a config flag, which may or may not have a valid use. I'm not a networker or security expert, I cannot tell. - That config flag in turn causes two random number generators to interact via a global variable to cause a small off-by-one error. Furthermore, both code pieces don't look strinkingly wrong, from a cursory glance by someone not familiar with the code base. I've seen worse code being approved in a review. - This boundary error leaks internal state of the inner EC-based PRNG, which allows an attacker with prior knowledge, sufficient computing capacity and solid knowledge of math and crypto to get the state of the inner RNG - This information can be exfiltrated through both a complex queue/pool-system and a complex handshaking protocol. Maybe I'm more familiar with PRNGs, but the IKE part started to go over my head. I've always acknowledged the idea of very subtle, deniable and complex vulnerability introduction, both through cryptographic conditions, subtle code and language issues and all of that. Software is hard and complex. But this is an example that's both scary, very complex and close enough to comprehension to be very, very scary without being vague. Thank you for the analysis and the write-up.