Re: is "premature next" a real world rng concern, or just an academic exercise?

From: Pavel Machek <pavel@ucw.cz>
To: Yevgeniy Dodis <dodis@cs.nyu.edu>
Cc: "Jason A. Donenfeld" <Jason@zx2c4.com>, tytso <tytso@mit.edu>,
	Nadia Heninger <nadiah@cs.ucsd.edu>,
	Noah Stephens-Dawidowitz <noahsd@gmail.com>,
	Stefano Tessaro <tessaro@cs.washington.edu>,
	torvalds@linux-foundation.org, "D. J. Bernstein" <djb@cr.yp.to>,
	jeanphilippe.aumasson@gmail.com, jann@thejh.net,
	keescook@chromium.org, gregkh@linuxfoundation.org,
	Peter Schwabe <peter@cryptojedi.org>,
	linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: is "premature next" a real world rng concern, or just an academic exercise?
Date: Wed, 11 May 2022 22:46:50 +0200	[thread overview]
Message-ID: <20220511204650.GA21867@amd> (raw)
In-Reply-To: <CAMvzKsiMY_+8HZqeFqD3tR65a3-JB0LG=+0jBBy1zF4GanrsGA@mail.gmail.com>

[-- Attachment #1: Type: text/plain, Size: 1381 bytes --]

Hi!

> >
> > Thank you for starting this fascinating discussion. I generally agree with everything Jason said. In particular, I am not
> > 100% convinced that the extra cost of the premature next defense is justified.(Although Windows and MacOS are adamant it is
> > worth it :).)
> >

Dunno, how big is cost of "premature next" defenses? I believe all you
need to do is to reseed in batches, and that does not seem costly at
runtime, and does not have high cost in kernel .text.

> > But let me give some meta points to at least convince you this is not as obvious as Jason makes it sound.
> >
> > 1) Attacking RNGs in any model is really hard. Heck, everybody knew for years that /dev/random is a mess
> > (and we published it formally in 2013, although this was folklore knowledge),  but in all these years nobody
> > (even Nadya's group :)) managed to find a practical attack. So just because the attack seems far-fetched, I do not think we should
> > lower our standards and do ugly stuff. Otherwise, just leave
> >/dev/random the way it was before Jason started his awesome work.

Well, practical attacks may be hard, but when they happen... that's
bad. We had weak keys generated by debian, we have various devices
that with deterministic rngs...

Best regards,
								Pavel
-- 
People of Russia, stop Putin before his war on Ukraine escalates.

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 181 bytes --]