FreeBSD random number generator broken for last 4 months [LWN.net]

As several LWN readers have pointed out, John-Mark Gurney posted a message to the freebsd-current mailing list on February 17 noting that the random number generator (RNG) in the FreeBSD "current" kernel has been broken for the last four months. "If you are running a current kernel r273872 or later, please upgrade your kernel to r278907 or later immediately and regenerate keys. I discovered an issue where the new framework code was not calling randomdev_init_reader, which means that read_random(9) was not returning good random data. read_random(9) is used by arc4random(9) which is the primary method that arc4random(3) is seeded from. This means most/all keys generated may be predictable and must be regenerated. This includes, but not limited to, ssh keys and keys generated by openssl. This is purely a kernel issue, and a simple kernel upgrade w/ the patch is sufficient to fix the issue."

to post comments

FreeBSD random number generator broken for last 4 months

Posted Feb 18, 2015 15:36 UTC (Wed) by dougg (guest, #1894) [Link]

This from Wikipedia: "FreeBSD developers maintain at least two branches of simultaneous development. The -CURRENT branch always represents the 'bleeding edge' of FreeBSD development. A -STABLE branch of FreeBSD is created for each major version number, from which -RELEASE are cut about once every 4–6 months. If a feature is sufficiently stable and mature it will likely be backported (MFC or Merge from CURRENT in FreeBSD developer slang) to the -STABLE branch."

The vast majority of FreeBSD users should be using one of the supported _release_s: 8.4, 9.3 or 10.1, preferably the latter.

So the subject line, properly qualified, is a little like saying that lk 3.20-rc1 has a serious security issue.

FreeBSD random number generator broken for last 4 months

Posted Feb 18, 2015 16:17 UTC (Wed) by nnewton (subscriber, #40661) [Link] (18 responses)

Isn't this a pretty misleading title? It was broken in -CURRENT. Lots of things get broken in -CURRENT. The validity of reporting on security problems in dev branches seems fairly questionable.

FreeBSD random number generator broken for last 4 months

Posted Feb 18, 2015 16:44 UTC (Wed) by welinder (guest, #4699) [Link] (14 responses)

> The validity of reporting on security problems in dev branches
> seems fairly questionable.

It really depends on the nature.

Note, that merely updating the kernel won't fix problems. Already
generated keys will remain broken. That in and of itself is worth
reporting.

FreeBSD random number generator broken for last 4 months

Posted Feb 18, 2015 18:01 UTC (Wed) by nnewton (subscriber, #40661) [Link] (13 responses)

That is a good point. I think it was perhaps the title that made me question this. Hopefully this makes people more aware of the dangers of running -CURRENT. Particularly, the dangers of generating keys on a kernel that just had major work done on its random number generation :).

FreeBSD random number generator broken for last 4 months

Posted Feb 18, 2015 19:10 UTC (Wed) by rahvin (guest, #16953) [Link] (12 responses)

Good luck with that, people run this stuff and expect stability. As an example Debian testing has a warning that they occasionally break things (and they do) yet people screamed up, down and sideways because when they pulled systemd into testing they broke things. And just like this they didn't blame it on using the testing, they blamed it on the software.

Doesn't matter how big your warning is someone will post that they've never had problems running and then people start to rely on it and blam it will break and they will blame the software "because it's always been stable". I almost wonder if they shouldn't just do a release every so often that breaks everything just as a reminder not to use these development branches on production machines.

FreeBSD random number generator broken for last 4 months

Posted Feb 18, 2015 20:25 UTC (Wed) by k8to (guest, #15413) [Link] (11 responses)

The conversation with testing usually goes more like this.

Me (user): I have identified this problem in testing. Is this known?

Person purporting to speak on behalf of debian: Don't run testing.

And the conversation goes in circles for 15 minutes while they attack the me until someone finally provides the answer. "Yes it's a known problem since 2 weeks ago. Yes there is no secure way to update the repository keys." Or similar.

And later I eventually find my way to a solution and/or workaround.

In other words, it shouldn't be surprising that people yell about problems in testing, because the communication around problems in testing is so bad.

FreeBSD random number generator broken for last 4 months

Posted Feb 19, 2015 7:46 UTC (Thu) by ghane (guest, #1805) [Link] (6 responses)

My conversations go like this:

Me: There is a problem with testing
Colleague: What! Why are you running testing? Didn't you know debian says don't run testing? Does boss know?
Me: <whine> But I need gpsd from this decade! And I am the boss of the company!
Colleague: A friend of a friend ran testing once, and he was fired the next day, and his fridge ran out of beer.
Me: The three were related?
Colleague: No, but why tempt fate. Don't run testing.

FreeBSD random number generator broken for last 4 months

Posted Feb 19, 2015 12:12 UTC (Thu) by mathstuf (subscriber, #69389) [Link] (5 responses)

Heh. Seems people are more scared of testing than Rawhide (and there's experimental yet!). Usually my Rawhide bugs get completely ignored (usually closer to releases which is understandable), fixed within a reasonable time, or a "yeah…other stuff needs to land yet" (read: "probably should have built things in a side-tag") responses, but very rarely "that's a dumb idea".

FreeBSD random number generator broken for last 4 months

Posted Feb 19, 2015 21:22 UTC (Thu) by rodgerd (guest, #58896) [Link] (4 responses)

It's probably because lots of people get encouraged to try testing when they shouldn't, and it's got a undeservedly bad reputation as a result. In the RH universe I've got a smooth progression from CentOS/RHEL (reliable, out of date) to Fedora (won't be broken on a day-to-day basis, big changes every six months, fairly current software) to Rawhide (here be dragons).

In the Debianverse anyone who complains about out-of-date software in stable will be told to use testing because it's *practically* stable. This ends up being no fun for the person who discovers testing is not the same as fedora, or for the people maintaining testing who don't need to be doing end user support.

FreeBSD random number generator broken for last 4 months

Posted Feb 20, 2015 20:15 UTC (Fri) by Wol (subscriber, #4433) [Link] (2 responses)

It sounds also like people who *understand* "here be dragons" and want to help by providing bug reports, are actually being chased away by the developers!

If I choose to run something unstable, find a problem, and ask "is this a known issue?", then what's wrong with providing me with a yes/no answer? I'm not asking you to fix it, I just want to know whether I should be filing a bug report!

I know there are various shades of grey, but at the end of the day, I do know that if I ask a simple question and get a bunch of non-answers, it is extremely annoying. Especially when it is blatantly obvious either (a) they don't have a clue to my motives for asking, or (b) they clearly didn't bother to read the question properly.

Cheers,
Wol

FreeBSD random number generator broken for last 4 months

Posted Feb 21, 2015 23:59 UTC (Sat) by k8to (guest, #15413) [Link] (1 responses)

Typically it's not the developers responsible for the problem, but third party community members on webistes/mailing lists/irc/etc who suffer from a malady known as "know-it-alls". The actual developers are petty good.

FreeBSD random number generator broken for last 4 months

Posted Feb 23, 2015 4:22 UTC (Mon) by mathstuf (subscriber, #69389) [Link]

I would ask "so who is supposed to test *test*ing if no one is supposed to run it?" to those folks. I wonder if they think it should be renamed "dumping ground" or something.

FreeBSD random number generator broken for last 4 months

Posted Feb 21, 2015 12:02 UTC (Sat) by mpr22 (subscriber, #60784) [Link]

These days there's a reasonable chance that you'll be pointed to the backports system instead of directly to testing.

FreeBSD random number generator broken for last 4 months

Posted Feb 20, 2015 9:57 UTC (Fri) by jezuch (subscriber, #52988) [Link]

> Don't run testing.

Then how this "testing" is supposed to be, well, tested? Isn't the whole point of testing to be a staging ground where problems are found and fixed? So why this "person purporting to speak on behalf of Debian" is upset that someone found a problem in testing?

[Disclaimer: I run testing, updated daily. Yes, even at work (where it's updated weekly).]

FreeBSD random number generator broken for last 4 months

Posted Feb 20, 2015 12:20 UTC (Fri) by spaetz (guest, #32870) [Link] (2 responses)

> Don't run testing.

I recall conversations and posts that state that Debian has a de-facto rolling-release distribution called "testing". And if I remember correctly, there were attempts to promote testing as an accepted distribution that can be used by end-users. Or have I been dreaming this up?

FreeBSD random number generator broken for last 4 months

Posted Feb 20, 2015 12:38 UTC (Fri) by mpr22 (subscriber, #60784) [Link] (1 responses)

People have talked about making testing be that, under the banner CUT ("Continuously Usable testing").

However, that does not describe the nature of testing as it currently exists. Notably, testing spends, to a first approximation, six months out of every two years in a "freeze" state where it only receives updates to fix release-critical bugs pursuant to getting it into a state where it can become the new stable. For added fun, during the freeze, packages which have RC bugs are removed from testing (they remain in unstable) until an acceptable fixed version of the package is submitted.

(And after the freeze is over, it spends a couple of months in a flurry of updates and reinstatements.)

I'm currently running testing on my home desktop system, but I wouldn't use it in a "production" environment unless I had the resources available to set up a proper testbed environment.

FreeBSD random number generator broken for last 4 months

Posted Feb 20, 2015 19:38 UTC (Fri) by mathstuf (subscriber, #69389) [Link]

Yeah, I think No Frozen Rawhide (branching Rawhide off at Alpha rather than Beta or RC (I forget which)) has been a great improvement. It basically stalled development for projects where version x+1 couldn't be worked on/prepped because if it was targeted for Fedora N+1 because Rawhide was stuck with x which is targeted for Fedora N. It adds a month or two to the time to prep a release. Though the extra time is/should be lower activity since stabilizing the imminent release should be a priority, but not everyone works on critpath packages either.

FreeBSD random number generator broken for last 4 months

Posted Feb 18, 2015 20:49 UTC (Wed) by job (guest, #670) [Link] (2 responses)

Not at all. Any keys you generated on your workstation, if you run current, needs to be revoked. That's serious, and bears repeating.

It's the same order of magnitude of badness as the big Debian openssl fiasco, only for a fraction of the time and a fraction of the user base. At least Debian could push an update that revoked many bad keys automatically. I hope FreeBSD can do something similar.

FreeBSD random number generator broken for last 4 months

Posted Feb 19, 2015 0:34 UTC (Thu) by ncm (guest, #165) [Link] (1 responses)

"Openssh fiasco"

Although there are probably more than enough fiasci going around no matter where you look.

FreeBSD random number generator broken for last 4 months

Posted Feb 19, 2015 11:11 UTC (Thu) by cjwatson (subscriber, #7322) [Link]

No, the bug was in Debian's openssl packaging; it just had a particularly serious effect on openssh. (As Debian's openssh maintainer I quite like to be clear about this ...)

FreeBSD random number generator broken for last 4 months

Posted Feb 18, 2015 18:17 UTC (Wed) by cesarb (subscriber, #6266) [Link] (7 responses)

As a reminder: with DSA, keys not only generated, but merely *used* on a system with a broken RNG are compromised. (This does not apply to deterministic DSA or EdDSA.)

So if for instance the system had a ssh ECDSA key generated with a non-broken RNG, but used with a broken RNG, it should be discarded and regenerated (unless openssh used deterministic ECDSA).

FreeBSD random number generator broken for last 4 months

Posted Feb 18, 2015 21:06 UTC (Wed) by welinder (guest, #4699) [Link] (6 responses)

Details, please.

In particular, what constitutes use. Are you saying that anyone who has
ssh-ed *to* a machine running the buggy kernel should revoke? I don't
think I fall in that category, but it's a lot less obvious.

FreeBSD random number generator broken for last 4 months

Posted Feb 18, 2015 22:04 UTC (Wed) by cesarb (subscriber, #6266) [Link] (5 responses)

> Details, please.

https://en.wikipedia.org/wiki/Digital_Signature_Algorithm...

"With DSA, the entropy, secrecy, and uniqueness of the random signature value k is critical. It is so critical that violating any one of those three requirements can reveal the entire private key to an attacker.[11] Using the same value twice (even while keeping k secret), using a predictable value, or leaking even a few bits of k in each of several signatures, is enough to break DSA.[12]"

> In particular, what constitutes use. Are you saying that anyone who has ssh-ed *to* a machine running the buggy kernel should revoke? I don't think I fall in that category, but it's a lot less obvious.

Unless some particular detail of the way ssh uses DSA happened to avoid it (I haven't studied the SSH protocol), if you (or anyone else) used SSH to a machine running the buggy kernel, the buggy machine's DSA/ECDSA host key should be treated as compromised. If you used SSH *from* a machine running the buggy kernel, your DSA/ECDSA SSH private key should be treated as compromised.

That is, if you ever used the buggy kernel on a ssh server, regenerate the SSH DSA/ECDSA host keys; if you ever used the buggy kernel on a ssh *client*, and used SSH from it, regenerate the SSH client's DSA/ECDSA host keys. Unless, of course, the affected SSH server or client had protection against this problem (like deterministic DSA).

And that's only for ssh; anything which uses DSA or ECDSA can be affected. Web servers mostly use RSA, so it's not that much of a problem for them (unless the key was generated with the broken RNG), but I don't know about other protocols.

FreeBSD random number generator broken for last 4 months

Posted Feb 19, 2015 5:09 UTC (Thu) by Paf (subscriber, #91811) [Link] (4 responses)

My take away from this is it's still only the keys which were actually generated on a machine with the buggy kernel are at risk. Did I misunderstand something?

FreeBSD random number generator broken for last 4 months

Posted Feb 19, 2015 6:12 UTC (Thu) by eternaleye (guest, #67051) [Link] (3 responses)

When you sign a message using DSA, it requires a nonce. If the nonce is ever reused, bits of the private key are leaked. Deterministic DSA constructions produce the nonce as a function of the message, but in many cases the nonce is simply randomness. If the randomness is weak, it's much more likely to repeat. Note that this is how the PS3 signing key was cracked - IIRC, Sony used the same nonce whenever they signed an update, allowing the private key to be recovered.

FreeBSD random number generator broken for last 4 months

Posted Feb 19, 2015 9:19 UTC (Thu) by cesarb (subscriber, #6266) [Link] (2 responses)

> If the nonce is ever reused, bits of the private key are leaked.

It's worse than that. If the nonce can be guessed, simple math can give you the private key (see http://rdist.root.org/2009/05/17/the-debian-pgp-disaster-...). If *bits* of the nonce can be guessed, with several signatures more complicated math can give you the private key. If the same nonce is used more than once, you can find the nonce (see http://rdist.root.org/2010/11/19/dsa-requirements-for-ran...). Non-deterministic DSA is that fragile.

FreeBSD random number generator broken for last 4 months

Posted Feb 19, 2015 11:42 UTC (Thu) by Otus (subscriber, #67685) [Link] (1 responses)

In ssh's case, say the server's RNG is broken. Which nonces will that affect and which keys can thus be leaked? The host keys only or also client keys?

And the same questions for if the client is the one with a buggy RNG.

FreeBSD random number generator broken for last 4 months

Posted Feb 19, 2015 12:03 UTC (Thu) by cesarb (subscriber, #6266) [Link]

> In ssh's case, say the server's RNG is broken. Which nonces will that affect and which keys can thus be leaked? The host keys only or also client keys?

One can't leak what one doesn't have. If the system with the broken RNG doesn't have a private key, it can't leak it. So in the server's case, only the host key (which the server has the private key for) can be leaked. Of course, as I said before, I don't know if openssh has anything (like use of deterministic DSA) which would prevent the leak.

> And the same questions for if the client is the one with a buggy RNG.

The client only has access to the client keys, so it can only leak them.