6 ms·

What are the characteristics of those who generated an RSA key sharing a prime factor? Can they be linked back to a few bad CSPRNG implementations? What are pr

What are the characteristics of those who generated an RSA key sharing a prime factor? Can they be linked back to a few bad CSPRNG implementations? What are practical steps to be responsible about it? It's contrived, but I just imagine that if I'm generating some particularly important keys, that I should somehow find a way to give /dev/urandom a kick of some kind. Even if that were possible, it's more likely to make things worse than better. Still, it makes me a little paranoid to even hear about theoretical weaknesses -- especially like collision attacks. I have no idea how long it takes for the CSPRNG to get properly seeded. Does it take a microsecond after booting? 10 minutes? A day?

z3t4 8y ago
Some RNG's use the time of the day in milliseconds as seed, I guess those are easy to brute force. I guess it's all about the size of the seed and it's randomness!?
- schoen 8y ago
  This is probably the most famous issue about that phenomenon: https://people.eecs.berkeley.edu/~daw/papers/ddj-netscape.html https://people.eecs.berkeley.edu/~daw/papers/ddj-netscape.ht... You could say that our understanding of PRNGs has improved a bit since then. A recent thread about brute-forcing PRNG states in a game: https://news.ycombinator.com/item?id=18880528 https://news.ycombinator.com/item?id=18880528
  - rincebrain 8y ago
    I would have thought https://github.com/g0tmi1k/debian-ssh https://github.com/g0tmi1k/debian-ssh would be the most famous issue in many people's memories of poor (read: absent) PRNG use. ;)
- NelsonMinar 8y ago
  One would hope no RSA key generation software is so stupid as to use that kind of RNG. OTOH, apparently 0.2% of RSA keys were generated by something effectively that dumb.
tptacek 8y ago
At the time, there was uncertainty about the root cause, but yes, I think it's been traced back to a set of specific CSPRNGs. You do not need to give urandom a kick of any kind; once the KRNG is seeded, urandom will for all intents and purposes perpetually feed you secure random bytes. It's likely your distro already goes through some effort to make sure urandom is seeded by the time you start up a shell.

z3t4 8y ago

Some RNG's use the time of the day in milliseconds as seed, I guess those are easy to brute force. I guess it's all about the size of the seed and it's randomness!?

schoen 8y ago
This is probably the most famous issue about that phenomenon: https://people.eecs.berkeley.edu/~daw/papers/ddj-netscape.html https://people.eecs.berkeley.edu/~daw/papers/ddj-netscape.ht... You could say that our understanding of PRNGs has improved a bit since then. A recent thread about brute-forcing PRNG states in a game: https://news.ycombinator.com/item?id=18880528 https://news.ycombinator.com/item?id=18880528
- rincebrain 8y ago
  I would have thought https://github.com/g0tmi1k/debian-ssh https://github.com/g0tmi1k/debian-ssh would be the most famous issue in many people's memories of poor (read: absent) PRNG use. ;)
NelsonMinar 8y ago
One would hope no RSA key generation software is so stupid as to use that kind of RNG. OTOH, apparently 0.2% of RSA keys were generated by something effectively that dumb.

tptacek 8y ago

At the time, there was uncertainty about the root cause, but yes, I think it's been traced back to a set of specific CSPRNGs. You do not need to give urandom a kick of any kind; once the KRNG is seeded, urandom will for all intents and purposes perpetually feed you secure random bytes. It's likely your distro already goes through some effort to make sure urandom is seeded by the time you start up a shell.