3 ms·
Would a broken RNG be a risk to leak private keys? As in, even if the key was generated on a safe kernel, merely using the key to encrypt or sign data on the br
by 0x0 12y ago
Would a broken RNG be a risk to leak private keys? As in, even if the key was generated on a safe kernel, merely using the key to encrypt or sign data on the broken kernel would compromise the keys?
This article mentions DSA private keys and poor RNGs: http://rdist.root.org/2010/11/19/dsa-requirements-for-random-k-value/ http://rdist.root.org/2010/11/19/dsa-requirements-for-random...
- atonse 12y agoNot sure about the keys themselves if they've already been generated, but even after a key is generated, a lot of situational stuff involves random numbers (session keys, initialization vectors, nonces, etc), and lesser variation in these can make it easier to attack traffic with known content patterns.
- emaste 12y agoThis is a very good point, one that I missed in my followup on the FreeBSD-CURRENT mailing list. See also https://www.imperialviolet.org/2013/06/15/suddendeathentropy.html https://www.imperialviolet.org/2013/06/15/suddendeathentropy...
- tylersmith 12y agoYes, even with correctly generated keys if you perform DSA signatures with a broken RNG you risk reusing a k value which will leak your private key.
- caf 12y agoYou don't even have to re-use a k value - if the attacker can guess your k value, one signature is enough to recover your private key.