4 ms·
The PRNG state is responsible for generating most of the users cryptographic material and is quite important to the system’s security. As such, the PRNG State i
by kurikuri 3y ago
The PRNG state is responsible for generating most of the users cryptographic material and is quite important to the system’s security. As such, the PRNG State is a security parameter that should never be exportable nor importable.
There are many new attacks that could surface if import/export were possible; off the top of my head: quiet preloading of an attacker-selected state while the machine is off.
- 1000thVisitor 3y ago> quiet preloading of an attacker-selected state while the machine is off. That attacker with physical access can chose from multiple other attacks, so why bother making this one more secure. They can sniff keyboard strokes, install malware into the UEFI, etc. pp.
- yencabulator 3y agoYou don't need to export the current running kernel PRNG internal state, all you need is to save an unpredictable seed that can be used to fill the kernel entropy pool after next boot. https://systemd.io/RANDOM_SEEDS/ https://systemd.io/RANDOM_SEEDS/
- Asmod4n 3y agoJust do what netbsd recommends and you should be fine https://man.netbsd.org/urandom.4 https://man.netbsd.org/urandom.4 They explicitly state you should dog feed the prng on every shutdown and boot and also explain why that isn’t an issue.
- GoblinSlayer 3y ago>quiet preloading Just preload the OS then.