4 ms·
> Any hardware RNG that is included in a CPU or any other complex integrated circuit cannot be trusted, because it is impossible to verify that it is truly a R
by dragontamer 4y ago
> Any hardware RNG that is included in a CPU or any other complex integrated circuit cannot be trusted, because it is impossible to verify that it is truly a RNG and not a pseudo-RNG that implements backdoors.
If the opponent has enough control of your CPU to rewrite your assembly instructions to do nefarious things, you have more than just RDSEED to worry about.
- adrian_b 4y agoFor the RNG to be backdoored there is no need for something as unlikely as "rewriting assembly instructions". It is enough for the supposedly random numbers to be non-random, i.e. deterministic, according to a function known only by the designers of the hardware RNG. It is impossible to distinguish by testing a true RNG from a good pseudo-RNG. Designing a hardware pseudo-RNG instead of the claimed true RNG is a trivial task. Succeeding to exploit it to decrypt something, e.g. some HTTPS traffic, is however not very likely, because it is easy to avoid this by combining the output of RDSEED with other sources of random numbers and by processing it, e.g. by hashing. So it can be hoped that the designers of a hardware RNG do not attempt to backdoor it, because the chances of that being used successfully are low and the penalty if that would ever be discovered is high.