Re: Working exploit for Debian generated SSH Keys

["Garrett M. Groff" <groffg () gmgdesign com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Yep, agreed.

- - G



Salut, Garrett,

On Mon, 19 May 2008 13:51:29 -0400, Garrett M. Groff wrote:
> Generating pseudo-random numbers isn't hard given a good API, but
> writing that API is non-trivial (assuming you want high entropy/low
> predictability). And, apparently, screwing up that API is also very
> easy.

Generating real pseudo-random streams is a hard problem which is way
more than what people can handle. Usually, PRNGs are composed of
various periodic elements which, in the end, all combined produce a
repeating stream of pseudo-random numbers. OpenSSL uses a modified MAC
for this as a state machine and extracts some state bits as random
stream on every access.

We're not debating the PRNG itself here but the _seed_. OpenSSL
supports various ways to influence the state of the PRNG at various
stages by XORing in new material; however, Debian chose to only support
pre-seeding with uninitialized memory and the Process ID. With the
elimination of the uninitialized memory as seed, the seed for the MAC
was entirely comprised by the PID.

So we're not debating a weakness in the PRNG here at all, which is a
_very_ delicate subject.

    Tonnerre
- -- 
SyGroup GmbH
Tonnerre Lombard

Solutions Systematiques
Tel:+41 61 333 80 33  Güterstrasse 86
Fax:+41 61 383 14 67  4053 Basel
Web:www.sygroup.ch  tonnerre.lombard () sygroup ch

-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.6.2 (Build 2014) - not licensed for commercial use: 
www.pgp.com

wj8DBQFIMsjuSGIRT5oVahwRAlLrAJ9O7/osiw1tbwq7tjWPV0jjn/53dQCgwjik
IZ7FHvEZJsdKXiRkRvE5uN4=
=/qAR
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/