A system call for random numbers: getrandom()

Posted Jul 28, 2014 0:13 UTC (Mon) by raven667 (subscriber, #5198)
In reply to: A system call for random numbers: getrandom() by nybble41
Parent article: A system call for random numbers: getrandom()

I'm a bit of a layman, I didn't know that the PRNG was considered successfully seeded with only 32 bits, that seems awfully low, 256 bits sounds like a more reasonable number. It seems to be that it would be doable for a well financed organization to run the PRNG algorithm through every possible 32 bit seed value for a couple of megabytes of output at least. System startup isn't exposed to that many random variables, so it wouldn't surprise me if randomness taken from IRQ/IO timings and whatnot were clustered and not white noise there is enough different hardware/software combinations out there that this might not matter in a practical sense but your 32 bits of entropy is really something slightly smaller.

Over time as new randomness was folded in and the offset gets larger then I would have confidence that the state would be too random to predict but anything that uses the PRNG output shortly after it is initially set up seems that it could be using predictable values. This would seem to be of concern to users of randomness early in the boot process, ssh key generation being the most obvious, but there are other things which use randomness.

I would presume that the people who actually fully understand this stuff have thought about all of these things and are way ahead of a layman such as myself in mitigating these issues.

A system call for random numbers: getrandom()

Posted Jul 28, 2014 15:36 UTC (Mon) by apoelstra (subscriber, #75205) [Link] (1 responses)

>I didn't know that the PRNG was considered successfully seeded with only 32 bits

It's not :) unless the parent post was just giving example numbers, he meant to say "32 bytes" or 256 bits.

A system call for random numbers: getrandom()

Posted Jul 28, 2014 22:20 UTC (Mon) by nybble41 (subscriber, #55106) [Link]

The parent post was just giving example numbers. Those 32 bits would indeed be a fairly small seed for something like /dev/urandom, though it was the standard size for the C library's PRNG seed on 32-bit systems. (Hopefully no one was relying on rand() for anything security-related.)

On the other hand, if you seed /dev/urandom with 256 bits, but all but 32 of those bits are predictable to an attacker, you might as well be using a mere 32-bit seed... some entropy-starved embedded systems may be in this situation shortly after startup.