FreeBSD random number generator broken for last 4 months

> Details, please.

https://en.wikipedia.org/wiki/Digital_Signature_Algorithm...

"With DSA, the entropy, secrecy, and uniqueness of the random signature value k is critical. It is so critical that violating any one of those three requirements can reveal the entire private key to an attacker.[11] Using the same value twice (even while keeping k secret), using a predictable value, or leaking even a few bits of k in each of several signatures, is enough to break DSA.[12]"

> In particular, what constitutes use. Are you saying that anyone who has ssh-ed *to* a machine running the buggy kernel should revoke? I don't think I fall in that category, but it's a lot less obvious.

Unless some particular detail of the way ssh uses DSA happened to avoid it (I haven't studied the SSH protocol), if you (or anyone else) used SSH to a machine running the buggy kernel, the buggy machine's DSA/ECDSA host key should be treated as compromised. If you used SSH *from* a machine running the buggy kernel, your DSA/ECDSA SSH private key should be treated as compromised.

That is, if you ever used the buggy kernel on a ssh server, regenerate the SSH DSA/ECDSA host keys; if you ever used the buggy kernel on a ssh *client*, and used SSH from it, regenerate the SSH client's DSA/ECDSA host keys. Unless, of course, the affected SSH server or client had protection against this problem (like deterministic DSA).

And that's only for ssh; anything which uses DSA or ECDSA can be affected. Web servers mostly use RSA, so it's not that much of a problem for them (unless the key was generated with the broken RNG), but I don't know about other protocols.