2 ms·
The issue isn't whether RDRAND is backdoored; it's that the output from the RDRAND circuitry is fed directly to an AES whitener, and the only thing you can test
by denton-scratch 5y ago
The issue isn't whether RDRAND is backdoored; it's that the output from the RDRAND circuitry is fed directly to an AES whitener, and the only thing you can test about the RDRAND output is the whitened output from AES.
Well, the output from AES is by definition indistinguishable from randomness, unless you have the key. So to test a TRNG, you need access to the input to the whitener. Intel doeesn't provide that access. So the hardware might be producing a continuous stream of zeroes, and you'd never know from examining the output of the whitener.
I believe Intel chips with RDRAND have been inspected using electron microscopes, and no flaw has been found in the hardware (I think it's two free-running oscillators whose outputs are sampled and XORed).
- foxfluff 5y agoThe other problem with RDRAND is that you just can't trust them to get it right. How about always returning 0xffffffff? https://arstechnica.com/gadgets/2019/10/how-a-months-old-amd-microcode-bug-destroyed-my-weekend/ https://arstechnica.com/gadgets/2019/10/how-a-months-old-amd... How about a bunch of collisions? https://github.com/systemd/systemd/issues/18184 https://github.com/systemd/systemd/issues/18184 Thanks, AMD...