4 ms·

Because your intuition about the ease of building random number generators is wrong, especially if they need to be cryptographically secure. I trust my OS’ RNG

Because your intuition about the ease of building random number generators is wrong, especially if they need to be cryptographically secure. I trust my OS’ RNG functions[1] far more than I trust third party code to be right, and I trust it a million times more than I trust myself to get it right. Trusting a small core of validated code is far more likely to be correct in the long term. Wireguard’s mistake was not using what the OS gave them; I’m not sure why they didn’t. [1]: https://man.openbsd.org/arc4random.3 https://man.openbsd.org/arc4random.3

Tharre 7y ago
WireGuard is a kernel module, it already uses what the kernel gave it, which is get_random_u32(). Note that this is NOT used for anything crypto related, it's just used in the hashtable code.
- owenmarshall 7y ago
  Amazing. Apologies to the Wireguard folks: first for casting aspersions, second that they have to deal with such a trash heap of an API.
a1369209993 7y ago
No, building random number generators is easy; the reason arc4random was (it's been fixed) insecure was because arc4 was insecure. If you have a secure stream cipher, you have a secure RNG. Not "can build", they're the same thing. If you only have block ciphers, the security proof is less trivial, but in practice "decrypt /dev/zero" still works. If you don't have a secure (symmetric) cipher, you have bigger crypographic problems than bad random numbers.
pingyong 7y ago
Just to follow up on this funnily enough, the Wireguard guys actually did call a kernel function: https://news.ycombinator.com/item?id=21391308 https://news.ycombinator.com/item?id=21391308 And again, like before, the reaction to this is just hilarious to me. "It's a kernel bug." - Yeah, sure, but your users don't care, and your users shouldn't have to care. Because this an easy problem to fix, and if you're worth your salt as a developer you should fix it. Evidently Wireguard isn't worth it's salt.

Tharre 7y ago

WireGuard is a kernel module, it already uses what the kernel gave it, which is get_random_u32(). Note that this is NOT used for anything crypto related, it's just used in the hashtable code.

owenmarshall 7y ago
Amazing. Apologies to the Wireguard folks: first for casting aspersions, second that they have to deal with such a trash heap of an API.

a1369209993 7y ago

No, building random number generators is easy; the reason arc4random was (it's been fixed) insecure was because arc4 was insecure. If you have a secure stream cipher, you have a secure RNG. Not "can build", they're the same thing. If you only have block ciphers, the security proof is less trivial, but in practice "decrypt /dev/zero" still works. If you don't have a secure (symmetric) cipher, you have bigger crypographic problems than bad random numbers.

pingyong 7y ago

Just to follow up on this funnily enough, the Wireguard guys actually did call a kernel function: https://news.ycombinator.com/item?id=21391308 https://news.ycombinator.com/item?id=21391308 And again, like before, the reaction to this is just hilarious to me. "It's a kernel bug." - Yeah, sure, but your users don't care, and your users shouldn't have to care. Because this an easy problem to fix, and if you're worth your salt as a developer you should fix it. Evidently Wireguard isn't worth it's salt.