3 ms·
Incidentally, D.J. Bernstein argues that hashing an additional randomness source sometimes _can_ hurt: http://blog.cr.yp.to/20140205-entropy.html http://blog.cr
by vilhelm_s 12y ago
Incidentally, D.J. Bernstein argues that hashing an additional randomness source sometimes _can_ hurt: http://blog.cr.yp.to/20140205-entropy.html http://blog.cr.yp.to/20140205-entropy.html
I guess it would be difficult in practice to make a malicious hardware randomness source, but it's an interesting perspective; to have confidence in your algorithm you should carefully restrict where the randomness enters it.
- wtallis 12y agoYeah, I've always found it odd how proponents of various entropy combining methods think it's reasonable to be afraid of hardware smart enough to know when to sabotage the RNG, but think it's unrealistic to postulate that it would also know the right way to poison their entropy pool.
- CHY872 12y agoThis sort of attack would be easy to defeat, though. For example, one fix would be to precompute a few megs of randomness data from your hardware source, and only use it after a few minutes have passed since generation. If the malicious RNG can predict the contents of the rest of the pool after this time (without modifying them) then there are bigger problems with the randomness generation.