Timeline for What to watch for with openssl generating weak keys? (low entropy)
Current License: CC BY-SA 3.0
13 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Sep 22, 2013 at 3:00 | review | Community Evaluations | |||
| Sep 30, 2013 at 3:00 | |||||
| Jul 25, 2013 at 6:42 | vote | accept | Brian Armstrong | ||
| Jul 25, 2013 at 0:13 | answer | added | osgx | timeline score: 19 | |
| Jul 24, 2013 at 23:48 | comment | added | Brian Armstrong | So given a private key/public key (and possibly some signatures it generated), is there any way to determine if it was generated using low entropy? | |
| Jul 24, 2013 at 23:38 | history | tweeted | twitter.com/#!/StackCrypto/status/360182123577098240 | ||
| Jul 24, 2013 at 22:28 | comment | added | Maarten Bodewes♦ | Note that the biggest issue with weak keys was that they did not use any random entropy. As PRNG's are deterministic, not having a random seed (from entropy) is of course catastrophic. Once it is seeded correctly most PRNG's are basically safe, unless there is a (side channel?) attack on the internal state. | |
| Jul 24, 2013 at 19:33 | comment | added | CodesInChaos | OpenSSL behaves properly if you use the right PRNG call. The other one is weak and using it doesn't just return bad data, it can also increase the time until the PRNG becomes secure. Unfortunately I forgot how the right call was called. | |
| Jul 24, 2013 at 19:33 | comment | added | rath |
256 bits from /dev/random shouldn't take any more than a few seconds, a minute at the most. As CodesInChaos noted you can have infinite entropy with a PRNG but as far as /dev/random is concerned, it can be drained quickly but not from a neighbour because it's being gathered at the OS level (if anything multiple VMs on the same machine would increase available entropy).
|
|
| Jul 24, 2013 at 19:24 | comment | added | Brian Armstrong | @CodesInChaos ok good distinction, thanks for the help. Does openssl block on startup in the way you described? I'm guessing a VM booting up doesn't have any state stored from previous shutdown or anything like that. Wondering how long it would take to get that 256 bits of entropy in practice on a server with no mouse/keyboard. A few seconds? Minutes? Thanks! | |
| Jul 24, 2013 at 19:17 | history | edited | Brian Armstrong | CC BY-SA 3.0 |
added 21 characters in body
|
| Jul 24, 2013 at 19:17 | comment | added | CodesInChaos | The core misunderstanding here is that entropy can be depleted. If you seed a PRNG once, it can churn out practically unlimited amounts of secure pseudo random data. So the only time a good PRNG should block is after startup, until it has acquired 256 bits of entropy, and never after that (perhaps excluding weird events like forks, hibernation, etc.). | |
| Jul 24, 2013 at 19:05 | review | First posts | |||
| Jul 24, 2013 at 20:20 | |||||
| Jul 24, 2013 at 18:48 | history | asked | Brian Armstrong | CC BY-SA 3.0 |