7 ms·

I don't think straight hashing is enough. Suppose the internal RNG is just AES in counter mode(Assume somehow they can persist state internally) They then kno

I don't think straight hashing is enough. Suppose the internal RNG is just AES in counter mode(Assume somehow they can persist state internally) They then know the full list of numbers it will ever make. They also know the full list of hashed numbers it will ever make, if they know the hashed block size, which they do if they know what software you are using. Now when you make a private key they just try all trillion possible offsets into the list of numbers it could likely be, hash those 32 bytes or whatever the block size is, and see if that's your key. But I am not the paranoid type nor do I currently have things to hide from anyone with access to Intel backdoors, so I'm not too worried. I think Linux has it pretty well figured out mixing in other sources just to be sure.

adrian_b 4y ago
It is completely impractical to store a table of hash values that is large enough to be able to reverse the hash. No HDD will be big enough. Moreover, as I have already written, this possibility is easily circumvented by also hashing a time-varying value and a value unique to each computer, not only the RNG output.
- eternityforest 4y ago
  If the unique value is secret, yes. Otherwise there is no need to store a table of values. If a home type PC is used for a year, there will be a finite amount of randomness used from the HW generator in total. Probably under a terabyte I would guess. Maybe under a gigabyte. If you are doing something like looking for an encryption key, you know it's somewhere in that terabyte, which you can generate too, then put every possible block through your hash, and try it. You don't even need to store anything, you can just generate them since they're deterministic. And if the backdoor is based on a block cipher in in counter mode or something like that, you can do it all in parallel on FPGAs in seconds if you're a billionaire.

adrian_b 4y ago

It is completely impractical to store a table of hash values that is large enough to be able to reverse the hash. No HDD will be big enough. Moreover, as I have already written, this possibility is easily circumvented by also hashing a time-varying value and a value unique to each computer, not only the RNG output.

eternityforest 4y ago
If the unique value is secret, yes. Otherwise there is no need to store a table of values. If a home type PC is used for a year, there will be a finite amount of randomness used from the HW generator in total. Probably under a terabyte I would guess. Maybe under a gigabyte. If you are doing something like looking for an encryption key, you know it's somewhere in that terabyte, which you can generate too, then put every possible block through your hash, and try it. You don't even need to store anything, you can just generate them since they're deterministic. And if the backdoor is based on a block cipher in in counter mode or something like that, you can do it all in parallel on FPGAs in seconds if you're a billionaire.