3 ms·
There are two problems with that: 1) If you expected the filter algorithm to detect and warn on bad/malicious randomness, this doesn't work 2) More importantl
by goodpoint 5y ago
There are two problems with that:
1) If you expected the filter algorithm to detect and warn on bad/malicious randomness, this doesn't work
2) More importantly, if you have a CSPRNG and a source of randomness as part of your filter you can simply throw away the "coin" because just implemented your own RNG.
- eru 5y agoI don't expect (1). For (2), yes, it's essentially that; but you add some extra mechanisms around to make use of any entropy sources you can find, even if some of them are tainted. Basically what /dev/random does in Linux: they still use the potentially tainted 'coins' despite having a CSPRNG.
- goodpoint 5y ago> Basically what /dev/random does in Linux: they still use the potentially tainted 'coins' despite having a CSPRNG. Yes, this is well known. Any reseeding of the CSPRNG is good if you steer it in with XOR.
- eru 5y agoMostly, but not completely. If your adversary knows your secret state, they can tailor their to-be-XOR-ed data to steer your state wherever they want to. The threat model where this is realistic is when your adversary built your hardware random number generator that you use to add entropy to your pool. (And that's assuming that this piece of hardware can see the other entropy sources that go into your pool, but can not directly exfiltrate that information into the outside world.)