I'm using my own code to communicate with another party that's specified PKCS#1 V2.1 EME-OAEP encoding, with SHA-1 as the hash function.

There are two places where random data is used in encoding a message:

  1. A 20-byte seed which is passed to Mask Generation Function.
  2. A variable amount of random data which left-pads the message, when the message is shorter than the block.

For these uses, is it OK to use an operating system rand function, which is probably a weak LCG; or should I use a CSPRNG such as ISAAC (which will have been seeded from the weak LCG)?

  • $\begingroup$ You probably shouldn't do any of those things. Certainly, seeding a CSPRNG with a weak source of randomness, is not much better than just using a weak randomness source. I.e., if the seed is predictable then so are the outputs of the CSPRNG. $\endgroup$ – Guut Boy Oct 28 '16 at 7:45
  • $\begingroup$ What are the environment constraints that prevent the use of a strongly-seeded OS-level CSPRNG such as /dev/urandom? $\endgroup$ – rmalayter Oct 28 '16 at 8:49
  • $\begingroup$ @rmalayter embedded device ... no strong OS-level RNG $\endgroup$ – M.M Oct 28 '16 at 10:03

Use HKDF to generate your random data with inputs of your private key, the message being signed, and whatever entropy you do have available (such as a real-time clock value or other time stamp).

This way all random values you produce will be completely unpredictable to anyone without your private key, and will change with each message even if you have zero effective bits of additional entropy available.

Also, move away from SHA-1 if you can; it provides <70 bits of effective security when used in signatures, and you'll have interoperability issues in the near future without SHA-256 if you're also using any standardized protocols such as TLS.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.