Full Disclosure: Re: Working exploit for Debian generated SSH Keys

[Tonnerre Lombard <tonnerre.lombard () sygroup ch>]

Salut, Garrett,

On Mon, 19 May 2008 13:51:29 -0400, Garrett M. Groff wrote:
> Generating pseudo-random numbers isn't hard given a good API, but
> writing that API is non-trivial (assuming you want high entropy/low
> predictability). And, apparently, screwing up that API is also very
> easy.
Generating real pseudo-random streams is a hard problem which is way
more than what people can handle. Usually, PRNGs are composed of
various periodic elements which, in the end, all combined produce a
repeating stream of pseudo-random numbers. OpenSSL uses a modified MAC
for this as a state machine and extracts some state bits as random
stream on every access.

We're not debating the PRNG itself here but the _seed_. OpenSSL
supports various ways to influence the state of the PRNG at various
stages by XORing in new material; however, Debian chose to only support
pre-seeding with uninitialized memory and the Process ID. With the
elimination of the uninitialized memory as seed, the seed for the MAC
was entirely comprised by the PID.

So we're not debating a weakness in the PRNG here at all, which is a
_very_ delicate subject.

                                Tonnerre
-- 
SyGroup GmbH
Tonnerre Lombard

Solutions Systematiques
Tel:+41 61 333 80 33            Güterstrasse 86
Fax:+41 61 383 14 67            4053 Basel
Web:www.sygroup.ch              tonnerre.lombard () sygroup ch

Attachment: signature.asc
Description:

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/