4 ms·
It's clear, yes, but it's also a blind assertion: we know what we're doing, you don't. He doesn't explain any of the reasoning, just that RdRand is one of many
by trebor 13y ago
It's clear, yes, but it's also a blind assertion: we know what we're doing, you don't. He doesn't explain any of the reasoning, just that RdRand is one of many inputs. The question, and its follow up question, by Dale are reasonable. As the data is XORed after the SHA and fold operations, what's to stop the chip from having a way to predict the output?
http://dilbert.com/strips/comic/2001-10-25/ http://dilbert.com/strips/comic/2001-10-25/
- hannibal5 13y agoI don't think he has to explain anything. It's clear that change.org petition was result of circle jerk that caused unnecessary confusion. Everyone is entitled to their opinion, but not everyone is entitled to professional opinion. When I read about the issue, I was little concerned but did not follow trough. It seems that the whole issue started from people who don't know what they they are talking and who did not check facts. More and more people join and take the SOME approach of enjoying the discussion but not doing the work. This causes FUD and is bad thing. People who do this should be burned just like Linus did. Btw. Using XOR to mix two random streams is textbook correct way to do it. It's simple and correct .
- trebor 13y agoI would prefer a cryptographer, not Linus, to weigh in on how Linux's PRNG works and what impact RdRand would have on it. It's not that I distrust Linus, it's just that it's hard to separate the vitriol from the facts. That, and a second opinion on the matter would settle it. That'd put the FUD to rest. However, I found this message a good explanation of what RdRand is/does and how they're integrating it with /dev/random. http://www.spinics.net/lists/linux-crypto/msg05883.html http://www.spinics.net/lists/linux-crypto/msg05883.html
- simias 13y agoIf you're willing to believe Linux's PRNG is not biased in any way then you're fine, because anything ^ random -> random. That's the principle behind the one-time pads: https://en.wikipedia.org/wiki/One-time_pad https://en.wikipedia.org/wiki/One-time_pad Worst case (say, a string of 0s) you don't add any entropy to the pool. But you can't actually remove entropy with a simple xor. Again, that's assuming there are no other weaknesses in the linux PRNG.
- hannibal5 13y agoLinus was responding to totally unsubstantiated request based on wrong information. The guy behind /dev/random is Ted Ts'o who has worked as Kerberos V5 project leader is part of security area directorate in IETF and chair of IPSec working group. As far as I see /dev/random uses the best practices and don't innovate unnecessarily. If somebody is willing to spend time actually vetting the implementation, that would be great.
- tptacek 13y agoWhoah whoah whoah let's not go too far here. There are things not to like about Linux devrandom. They have nothing to do with NSA backdoors, though.
- tptacek 13y agoI don't understand what this is supposed to mean. The chip doesn't have to "predict the output". It has the output already.
- trebor 13y agoYes, I didn't express myself clearly there. I was thinking of how the chip's output could possibly be used to attempt to predict the output of the PRNG and so be used in something like a side-channel attack. I'm not thinking it's highly likely, but with an organization of mathematicians and code breakers like the NSA has I wondered how much an advantage that would give against random keys, key exchanges, etc.
- riquito 13y agoA blind assertion? He told you which file to read in the sources. I suppose that if you say that randomization in Linux is broken reading a single .c file should'nt be a problem, and it would give all the evidence you will ever need.
- meapix 13y agothey were expecting a line by line code review from torvalds. what a shame. The code is there, either propose improvement or shut up, is my philosophy.