4 ms·
Yes. People have even experimented with using CPU specific instabilities in certain operations to extract entropy. http://www.irisa.fr/caps/projects/hipsor/mis
by __alexs 13y ago
Yes. People have even experimented with using CPU specific instabilities in certain operations to extract entropy.
http://www.irisa.fr/caps/projects/hipsor/misc.php#exectime http://www.irisa.fr/caps/projects/hipsor/misc.php#exectime
The problem with such systems is that is generally quite difficult to have confidence that they are not subject to attacks that may starve the system of entropy or trick the entropy estimator into thinking it has any when it has none.
Low-level hardware RNGs can be constructed in ways that make them quite difficult to attack externally, but are also basically impossible for us to verify.
Really it seems that the best approach is to take a wide range of flexible entropy sources and to learn to trust our mixing pools and trapdoor functions.
- wtbob 13y ago> The problem with such systems is that is generally quite difficult to have confidence that they are not subject to attacks that may starve the system of entropy or trick the entropy estimator into thinking it has any when it has none. That's why you give up on estimating entropy. It's just not possible in the general case. Mix multiple sources of potential entropy in a secure fashion (e.g. with a crypographically-secure hashing function). Recover over time from a compromise. > Really it seems that the best approach is to take a wide range of flexible entropy sources and to learn to trust our mixing pools and trapdoor functions. Yup, you're exactly right. Now we just need to convince Ted T'so to replace Linux's hacky /dev/random with a Fortuna-based one.
- __alexs 13y agoYou need some degree of entropy estimation at initialisation time or early boot numbers are predictable.