FreeBSD random number generator broken for last 4 months [LWN.net]

FreeBSD random number generator broken for last 4 months

Posted Feb 19, 2015 6:12 UTC (Thu) by eternaleye (guest, #67051)
In reply to: FreeBSD random number generator broken for last 4 months by Paf
Parent article: FreeBSD random number generator broken for last 4 months

When you sign a message using DSA, it requires a nonce. If the nonce is ever reused, bits of the private key are leaked. Deterministic DSA constructions produce the nonce as a function of the message, but in many cases the nonce is simply randomness. If the randomness is weak, it's much more likely to repeat. Note that this is how the PS3 signing key was cracked - IIRC, Sony used the same nonce whenever they signed an update, allowing the private key to be recovered.

to post comments

FreeBSD random number generator broken for last 4 months

Posted Feb 19, 2015 9:19 UTC (Thu) by cesarb (subscriber, #6266) [Link] (2 responses)

> If the nonce is ever reused, bits of the private key are leaked.

It's worse than that. If the nonce can be guessed, simple math can give you the private key (see http://rdist.root.org/2009/05/17/the-debian-pgp-disaster-...). If *bits* of the nonce can be guessed, with several signatures more complicated math can give you the private key. If the same nonce is used more than once, you can find the nonce (see http://rdist.root.org/2010/11/19/dsa-requirements-for-ran...). Non-deterministic DSA is that fragile.

FreeBSD random number generator broken for last 4 months

Posted Feb 19, 2015 11:42 UTC (Thu) by Otus (subscriber, #67685) [Link] (1 responses)

In ssh's case, say the server's RNG is broken. Which nonces will that affect and which keys can thus be leaked? The host keys only or also client keys?

And the same questions for if the client is the one with a buggy RNG.

FreeBSD random number generator broken for last 4 months

Posted Feb 19, 2015 12:03 UTC (Thu) by cesarb (subscriber, #6266) [Link]

> In ssh's case, say the server's RNG is broken. Which nonces will that affect and which keys can thus be leaked? The host keys only or also client keys?

One can't leak what one doesn't have. If the system with the broken RNG doesn't have a private key, it can't leak it. So in the server's case, only the host key (which the server has the private key for) can be leaked. Of course, as I said before, I don't know if openssh has anything (like use of deterministic DSA) which would prevent the leak.

> And the same questions for if the client is the one with a buggy RNG.

The client only has access to the client keys, so it can only leak them.