3 ms·
You're right; but the conclusion would still be "this is horrifically broken". A passive attacker can get all random generated since boot, and any internal RNG
by JoachimSchipper 9y ago
You're right; but the conclusion would still be "this is horrifically broken". A passive attacker can get all random generated since boot, and any internal RNG calls are not secret (neither in theory, nor probably in practice.)
One abstraction level up, hashing the output of a RNG is a bad countermeasure against a possibly-bad RNG. Good countermeasures including mixing the outputs of multiple RNGs and using protocols that don't require entropy.
- jorangreef 9y ago"hashing the output of a RNG is a bad countermeasure against a possibly-bad RNG" Why? I would think it's a fair suggestion for defense in depth, especially if you need to expose the result as a nonce, and you don't want to leak anything else unwittingly. It's also a good idea if you're not sure whether the entropy is evenly distributed, which is where something like HKDF would also want to hash the entropy source. "using protocols that don't require entropy" That rules out most secure protocol handshakes.
- wbl 9y agoYou could just use a better RNG in the first place.
- jorangreef 9y agoThe point is that it's not XOR. You can use a better RNG and also hash entropy before exposing it as a nonce. Why throw out defense in depth?