4 ms·

This is interesting, but I wonder what the real world application of this change would be. According to Linus, the Intel RdRand is only used as one of many sour

by foldor 13y ago

This is interesting, but I wonder what the real world application of this change would be. According to Linus, the Intel RdRand is only used as one of many sources of entropy in /dev/random. So even if it were compromised it wouldn't have a large impact on security. Source: http://www.change.org/en-GB/petitions/linus-torvalds-remove-rdrand-from-dev-random-4/responses/9066 http://www.change.org/en-GB/petitions/linus-torvalds-remove-...

clarry 13y ago
Not all applications use Linux. Not all applications go through Linux's /dev/random for their random needs. If you look into the discussion on, say, Theodore Tso's G+ entry on rdrand, you'll find that some people are eager to skip the OS and use rdrand directly.
- chatman 13y ago
  Most server applications run on GNU/Linux operating system. Those machines are usually the strategic targets of such attacks, not Windows based computers.
  - sp332 13y ago
    Theodore Tso is a Linux kernel developer.
chm 13y ago
Somebody posted this link on another discussion: http://cm.bell-labs.com/who/ken/trust.html http://cm.bell-labs.com/who/ken/trust.html There's no way to know for sure, but I don't think this is a problem for the average consumer. I'd like to think serious black hats are not amateur fishermen who use a bait to catch anything that passes by. I picture them more like a sniper waiting for the perfect shot on a valuable target. In other words, yes every system could be compromised, but the ones that are will be the ones holding more valuable information. And those are few relative to the mass of average joes. But then one might get an advantage from controlling a botnet, and use it to attack more valuable targets. I don't really know :)
- sliverstorm 13y ago
  It's the same as security always is. "What are my enemies capable of" is an absolutely critical component of the security equation that cannot be overlooked.
MertsA 13y ago
The only caveat is that if RdRand was made to output the bits about to be sent out XORed with a stream of AES(n++, NSA_KEY) then you get seemingly random data that is 100% deterministic once you know the key and completely invisible if you don't know the key.

by foldor 13y ago

clarry 13y ago

Not all applications use Linux. Not all applications go through Linux's /dev/random for their random needs. If you look into the discussion on, say, Theodore Tso's G+ entry on rdrand, you'll find that some people are eager to skip the OS and use rdrand directly.

chatman 13y ago
Most server applications run on GNU/Linux operating system. Those machines are usually the strategic targets of such attacks, not Windows based computers.
- sp332 13y ago
  Theodore Tso is a Linux kernel developer.

chm 13y ago

Somebody posted this link on another discussion: http://cm.bell-labs.com/who/ken/trust.html http://cm.bell-labs.com/who/ken/trust.html There's no way to know for sure, but I don't think this is a problem for the average consumer. I'd like to think serious black hats are not amateur fishermen who use a bait to catch anything that passes by. I picture them more like a sniper waiting for the perfect shot on a valuable target. In other words, yes every system could be compromised, but the ones that are will be the ones holding more valuable information. And those are few relative to the mass of average joes. But then one might get an advantage from controlling a botnet, and use it to attack more valuable targets. I don't really know :)

sliverstorm 13y ago
It's the same as security always is. "What are my enemies capable of" is an absolutely critical component of the security equation that cannot be overlooked.

MertsA 13y ago

The only caveat is that if RdRand was made to output the bits about to be sent out XORed with a stream of AES(n++, NSA_KEY) then you get seemingly random data that is 100% deterministic once you know the key and completely invisible if you don't know the key.