6 ms·
If the RNG instructions are malicious, they can reduce entropy, by for example XOR'ing into the result previous register values that held the previous entropy s
by Peaker 13y ago
If the RNG instructions are malicious, they can reduce entropy, by for example XOR'ing into the result previous register values that held the previous entropy source values.
- klodolph 13y agoThat doesn't reduce entropy, it just fails to increase it.
- Peaker 13y agoIt might reduce it, if it XORs away entropy that was previously XOR'd into it.
- ars_technician 13y agoSorry, that's not how entropy works with XOR. If you do not know one of the inputs to an XOR, you know nothing about the output. XORing random sources is great because it acts as a minimum function for entropy of all of the sources. As long as you have just one good source, the output is good.
- wtallis 13y ago> If you do not know one of the inputs to an XOR Aren't we talking about potential backdoors built in to the CPU? As in, having full access to all the registers?
- gefh 13y agoThe processor could recognize that it is in common key generation code, and generate 'entropy' that precisely reverses most of the existing entropy. The existing 'good' entropy could be known by the hardware PRNG.
- ars_technician 13y ago>The processor could recognize that it is in common key generation code This is very unrealistic. It would mean that processors have to be shipped with every crypto library implementation baked into the hardware. Any update would immediately break it.
- tedunangst 13y agoThe processor can also just write whatever it wants into the memory containing the entropy pool even if you never call the RDRAND instruction.
- dpe82 13y agoSure, but that's detectable. gefh's attack is not.
- tedunangst 13y agoHow so? Has anyone ever pulled the RAM sticks out of their computer to check that the entropy pool looks like they expect it to? Did they then verify that the L3 cache on the CPU had the same contents? Or did they simply ask the suspected backdoor CPU if the very memory it was just suspected of tampering with was clean? If you're going to open Pandora's box, I don't think you get to pick and choose what hypothetical backdoors to take out. It's particularly odd to only select the subset of backdoors that you can easily defend against.
- Perseids 13y agoAren't you talking about the Linux kernel? There the very last step is XOR'ing the random output with the hardware RNG. The article explicitly mentions Yarrow as a mixing and CSRNG function for FreeBSD though.