0
$\begingroup$

I'm using my own code to communicate with another party that's specified PKCS#1 V2.1 EME-OAEP encoding, with SHA-1 as the hash function.

There are two places where random data is used in encoding a message:

  1. A 20-byte seed which is passed to Mask Generation Function.
  2. A variable amount of random data which left-pads the message, when the message is shorter than the block.

For these uses, is it OK to use an operating system rand function, which is probably a weak LCG; or should I use a CSPRNG such as ISAAC (which will have been seeded from the weak LCG)?

Improve this question
$\endgroup$
3
  • $\begingroup$ You probably shouldn't do any of those things. Certainly, seeding a CSPRNG with a weak source of randomness, is not much better than just using a weak randomness source. I.e., if the seed is predictable then so are the outputs of the CSPRNG. $\endgroup$
    – Guut Boy
    Oct 28, 2016 at 7:45
  • $\begingroup$ What are the environment constraints that prevent the use of a strongly-seeded OS-level CSPRNG such as /dev/urandom? $\endgroup$
    – rmalayter
    Oct 28, 2016 at 8:49
  • $\begingroup$ @rmalayter embedded device ... no strong OS-level RNG $\endgroup$
    – M.M
    Oct 28, 2016 at 10:03

1 Answer 1

Reset to default
1
$\begingroup$

Use HKDF to generate your random data with inputs of your private key, the message being signed, and whatever entropy you do have available (such as a real-time clock value or other time stamp).

This way all random values you produce will be completely unpredictable to anyone without your private key, and will change with each message even if you have zero effective bits of additional entropy available.

Also, move away from SHA-1 if you can; it provides <70 bits of effective security when used in signatures, and you'll have interoperability issues in the near future without SHA-256 if you're also using any standardized protocols such as TLS.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.