15 ms·
My bad, but sounds like your response is ignoring all but one of my points. Keep in mind that the issue was present in Windows 2000 yet remained undetected for
by tjoff 9y ago
My bad, but sounds like your response is ignoring all but one of my points.
Keep in mind that the issue was present in Windows 2000 yet remained undetected for 7 years after the release of Windows 2000.
- tptacek 9y agoNot only that, but the Windows CryptGenRandom bug you're referring to (1) affects an ancient userland implementation of the Windows RNG, and (2) is principally effective as a second-order attack when someone has compromised the entropy pool. And this is the best example we've thus far come up with for a "kernel CSPRNG going bad". I'm very comfortable with the validity of the argument I'm making, which is that we don't generally need to layer rube goldberg hardware onto our systems to hedge against the likelihood of the LRNG going bad.
- tjoff 9y agoSo, would you be equally comfortable with stating that a hardware random generator doesn't solve any problems related to boot time entropy and the use of insecure RNGs by mistake?