4 ms·

A CPU executing arbitrary code that you didn't load is much, much easier to detect, than an RNG that looks random, but isn't. We already know that parties like

by throwaway2048 7y ago

A CPU executing arbitrary code that you didn't load is much, much easier to detect, than an RNG that looks random, but isn't. We already know that parties like the NSA have intentionally backdoored RNGs that made it into production use.

paulmd 7y ago
CPUs have been executing arbitrary code that you didn't load for more than a decade now. All Intel CPUs run a ring -3 supervisor core based on Minix, on AMD it's based on ARM TrustZone. If those supervisor cores want, they can literally just tamper with the entropy in your pool directly, they don't need to go through the charade of feeding it tampered entropy and then trying to un-mix it later.
- throwaway2048 7y ago
  That is extremely prone to breaking, and could be trivially detected if somebody was looking for it. It is far less risky detection wise to just tamper with the RNG directly.
- altfredd 7y ago
  > If those supervisor cores want, they can literally just tamper with the entropy in your pool directly Go ahead and try to tamper with that pool. On all existing and future kernel versions. After undoing kASLR. Not arguing, that it is impossible, but malware writers usually choose easier paths. When Samsung backdoored their phones [1], they didn't make a pure TrustZone rootkit. Instead they created a companion app, acting as helper for performing high-level tasks within OS bounds. Intel ME rootkit has it's own network stack and can use Intel network card, because it is both easier and safer than trying to interact with constantly updating OS, written by different people. A rootkit, trying to perform any kind of complex interactions with host OS, may be exploited and taken advantage of, — for example see bugs [2] in AMD's PSP, that allowed host OS to take over by giving it specially crafted certificate. [1]: https://www.zdnet.com/article/backdoor-in-samsung-galaxy-devices-allows-remote-access-to-data/ https://www.zdnet.com/article/backdoor-in-samsung-galaxy-dev... [2]: https://seclists.org/fulldisclosure/2018/Jan/12 https://seclists.org/fulldisclosure/2018/Jan/12

paulmd 7y ago

CPUs have been executing arbitrary code that you didn't load for more than a decade now. All Intel CPUs run a ring -3 supervisor core based on Minix, on AMD it's based on ARM TrustZone. If those supervisor cores want, they can literally just tamper with the entropy in your pool directly, they don't need to go through the charade of feeding it tampered entropy and then trying to un-mix it later.

throwaway2048 7y ago
That is extremely prone to breaking, and could be trivially detected if somebody was looking for it. It is far less risky detection wise to just tamper with the RNG directly.
altfredd 7y ago
> If those supervisor cores want, they can literally just tamper with the entropy in your pool directly Go ahead and try to tamper with that pool. On all existing and future kernel versions. After undoing kASLR. Not arguing, that it is impossible, but malware writers usually choose easier paths. When Samsung backdoored their phones [1], they didn't make a pure TrustZone rootkit. Instead they created a companion app, acting as helper for performing high-level tasks within OS bounds. Intel ME rootkit has it's own network stack and can use Intel network card, because it is both easier and safer than trying to interact with constantly updating OS, written by different people. A rootkit, trying to perform any kind of complex interactions with host OS, may be exploited and taken advantage of, — for example see bugs [2] in AMD's PSP, that allowed host OS to take over by giving it specially crafted certificate. [1]: https://www.zdnet.com/article/backdoor-in-samsung-galaxy-devices-allows-remote-access-to-data/ https://www.zdnet.com/article/backdoor-in-samsung-galaxy-dev... [2]: https://seclists.org/fulldisclosure/2018/Jan/12 https://seclists.org/fulldisclosure/2018/Jan/12