Re: RNG: is it possible to spoil /dev/random by seeding it from (evil) TRNGs

2012-10-09 Thread Christoph Anton Mitterer
On Sun, 2012-10-07 at 21:24 -0400, Theodore Ts'o wrote: > I've looked at his message, I didn't see any justification for his > concern/assertion. So I can't really comment on it since he didn't > give any reason for his belief. I asked him again[0] to be sure and he replied to have no reason to

Re: RNG: is it possible to spoil /dev/random by seeding it from (evil) TRNGs

2012-10-09 Thread Christoph Anton Mitterer
On Sun, 2012-10-07 at 21:24 -0400, Theodore Ts'o wrote: I've looked at his message, I didn't see any justification for his concern/assertion. So I can't really comment on it since he didn't give any reason for his belief. I asked him again[0] to be sure and he replied to have no reason to

Re: RNG: is it possible to spoil /dev/random by seeding it from (evil) TRNGs

2012-10-07 Thread Theodore Ts'o
On Mon, Oct 08, 2012 at 02:41:31AM +0200, Christoph Anton Mitterer wrote: > I just wondered because I remembered David Shaw (one of the main > developers from gpg) to imply[0] some time ago, that an "evil" entropy > source would actually be a problem: I've looked at his message, I didn't see any

Re: RNG: is it possible to spoil /dev/random by seeding it from (evil) TRNGs

2012-10-07 Thread Christoph Anton Mitterer
Hi Ted. Thanks for your prompt reply. On Thu, 2012-10-04 at 18:49 -0400, Theodore Ts'o wrote: > It is impossible by design. Or specifically, /dev/random was designed > so that it can be world-writeable, and an attacker can feed in any > kind of input he or she wants, and it will not allow the

Re: RNG: is it possible to spoil /dev/random by seeding it from (evil) TRNGs

2012-10-07 Thread Christoph Anton Mitterer
Hi Ted. Thanks for your prompt reply. On Thu, 2012-10-04 at 18:49 -0400, Theodore Ts'o wrote: It is impossible by design. Or specifically, /dev/random was designed so that it can be world-writeable, and an attacker can feed in any kind of input he or she wants, and it will not allow the

Re: RNG: is it possible to spoil /dev/random by seeding it from (evil) TRNGs

2012-10-07 Thread Theodore Ts'o
On Mon, Oct 08, 2012 at 02:41:31AM +0200, Christoph Anton Mitterer wrote: I just wondered because I remembered David Shaw (one of the main developers from gpg) to imply[0] some time ago, that an evil entropy source would actually be a problem: I've looked at his message, I didn't see any

Re: RNG: is it possible to spoil /dev/random by seeding it from (evil) TRNGs

2012-10-04 Thread Theodore Ts'o
On Thu, Oct 04, 2012 at 03:32:35PM +0200, Christoph Anton Mitterer wrote: > > When seeding the kernels entropy cache (which is then ultimately used > for /dev/random), e.g. by (semi-)TRNGs like haveged[0], > audio-entropyd[1], Simtec’s Entropy Key[2] or friends... can one spoil > the randomness

RNG: is it possible to spoil /dev/random by seeding it from (evil) TRNGs

2012-10-04 Thread Christoph Anton Mitterer
Hi. This is a question towards the crypto/entropy experts. When seeding the kernels entropy cache (which is then ultimately used for /dev/random), e.g. by (semi-)TRNGs like haveged[0], audio-entropyd[1], Simtec’s Entropy Key[2] or friends... can one spoil the randomness by that or is this

RNG: is it possible to spoil /dev/random by seeding it from (evil) TRNGs

2012-10-04 Thread Christoph Anton Mitterer
Hi. This is a question towards the crypto/entropy experts. When seeding the kernels entropy cache (which is then ultimately used for /dev/random), e.g. by (semi-)TRNGs like haveged[0], audio-entropyd[1], Simtec’s Entropy Key[2] or friends... can one spoil the randomness by that or is this

Re: RNG: is it possible to spoil /dev/random by seeding it from (evil) TRNGs

2012-10-04 Thread Theodore Ts'o
On Thu, Oct 04, 2012 at 03:32:35PM +0200, Christoph Anton Mitterer wrote: When seeding the kernels entropy cache (which is then ultimately used for /dev/random), e.g. by (semi-)TRNGs like haveged[0], audio-entropyd[1], Simtec’s Entropy Key[2] or friends... can one spoil the randomness by