DRBG seeding

2015-04-16 Thread Herbert Xu
Hi Stephan: Currently DRBG is seeded with entropy from get_random_bytes. However, get_random_bytes is basically the kernel version of /dev/urandom. So there is no guarantee that you're actually getting the amount of entropy required. Are you sure this is compliant with the DRBG specification?

Re: DRBG seeding

2015-04-16 Thread Stephan Mueller
Am Donnerstag, 16. April 2015, 22:36:17 schrieb Herbert Xu: Hi Herbert, Hi Stephan: Currently DRBG is seeded with entropy from get_random_bytes. However, get_random_bytes is basically the kernel version of /dev/urandom. So there is no guarantee that you're actually getting the amount of

Re: DRBG parallel requests

2015-04-16 Thread Stephan Mueller
Am Donnerstag, 16. April 2015, 22:44:55 schrieb Herbert Xu: Hi Herbert, Rafael, Hi Stephan: Currently you can have two users of DRBG issuing requests in parallel and end up using the same internal state. The only difference between them is the cycle counter that you inject into the DRBG. I

DRBG parallel requests

2015-04-16 Thread Herbert Xu
Hi Stephan: Currently you can have two users of DRBG issuing requests in parallel and end up using the same internal state. The only difference between them is the cycle counter that you inject into the DRBG. I can't see how this is safe as the cycle counter contains minimal entropy. The whole

Re: DRBG seeding

2015-04-16 Thread Stephan Mueller
Am Donnerstag, 16. April 2015, 23:26:18 schrieb Herbert Xu: Hi Herbert, On Thu, Apr 16, 2015 at 05:07:20PM +0200, Stephan Mueller wrote: I do not see a specific requirement in SP800-90A about the quality of the noise source. Well it explicitly says that you cannot use a DRBG. In the worst

Re: DRBG parallel requests

2015-04-16 Thread Stephan Mueller
Am Donnerstag, 16. April 2015, 23:30:38 schrieb Herbert Xu: Hi Herbert, On Thu, Apr 16, 2015 at 05:13:50PM +0200, Stephan Mueller wrote: Surely, the shadow approach scales better than a global lock. But its drawback is the (almost) identical state. The drawback is that your DRBG is no longer

Re: DRBG seeding

2015-04-16 Thread Herbert Xu
On Thu, Apr 16, 2015 at 05:07:20PM +0200, Stephan Mueller wrote: I do not see a specific requirement in SP800-90A about the quality of the noise source. Well it explicitly says that you cannot use a DRBG. In the worst case get_random_bytes is completely deterministic. That said, I already

Re: DRBG parallel requests

2015-04-16 Thread Herbert Xu
On Thu, Apr 16, 2015 at 05:13:50PM +0200, Stephan Mueller wrote: Surely, the shadow approach scales better than a global lock. But its drawback is the (almost) identical state. The drawback is that your DRBG is no longer anything like that specified by the standard. You've completely

Re: DRBG seeding

2015-04-16 Thread Andreas Steffen
Hi Stephan, in my opinion you definitively have to seed the DRBG with true entropy from /dev/random. This is what we are currently doing in userland with the strongSwan DRBG needed for the post-quantum NTRU-based key exchange algorithm. The NIST SP800-90A spec defines a parameter which estimates

Re: DRBG seeding

2015-04-16 Thread Herbert Xu
On Fri, Apr 17, 2015 at 03:19:17AM +0200, Stephan Mueller wrote: 1. during initialization of a DRBG instance, seed from get_random_bytes to have a DRBG state that is seeded and usable. I think we either need to use real entropy and block, or mark the DRBG unusable until such a time that it

Re: DRBG seeding

2015-04-16 Thread Stephan Mueller
Am Donnerstag, 16. April 2015, 19:11:18 schrieb Andreas Steffen: Hi Andreas, Hi Stephan, in my opinion you definitively have to seed the DRBG with true entropy from /dev/random. This is what we are currently doing in userland with the strongSwan DRBG needed for the post-quantum NTRU-based