3 ms·
> On every mainstream OS, including the two mainstream mobile OSs, RDRAND is (at best) one of several sources of entropy. Actually DJB has a pretty interesting
by zx2c4 13y ago
> On every mainstream OS, including the two mainstream mobile OSs, RDRAND is (at best) one of several sources of entropy.
Actually DJB has a pretty interesting post about how RDRAND and microcoded instructions could work together to control the OS's RNG output, even if several sources are mixed in, by monitoring the entropy pool and brute forcing each bit:
<http://blog.cr.yp.to/20140205-entropy.html> http://blog.cr.yp.to/20140205-entropy.html>
- tptacek 13y agoDJB's attack assumes that RDRAND does more than generate "evil" outputs, but that it also includes microcode that watches the entropy pool (which is constructed differently for every software RNG) so that it can know which output will generate a specific value. It's not just that it's an implausible attack (though it is; again, it assumes a hardware backdoor tuned to each OS's kernel CSPRNG). It's also the case that if the hardware is that thoroughly compromised, RDRAND is the least of your problems. It's a great post. It just isn't as damning as you might think it is.