/dev/random question

[RW]

On Sun, 16 Sep 2007 23:51:56 +0200
Mel <fbsd.questions at rachie.is-a-geek.net> wrote:

> On Sunday 16 September 2007 22:55:50 RW wrote:
> > On Sun, 16 Sep 2007 15:21:38 +0200

> An applicatation using /dev/random doesn't see the difference. It was 
> necessary at the time, because systems couldn't produce enough
> entropy, so they could put the application on hold till more was
> available. All the application wants is randomness and it accounts
> for the fact that it can be blocked, yet it never gets blocked so
> it's happy(tm) either way.
> 
> Also, I can't see how you can usefully improve on /dev/random other
> then getting rid of the blocking, so applications don't have to
> account for it.
> 
> > Using Yarrow for /dev/random is not an intrinsically bad idea, but
> > it is controversial.
> 
> Removing /dev/random all together would be controversial. This is
> just backwards compatibility. Nothing changed as far as a consumer
> of /dev/random is concerned. 

It's not about interfaces or performance - it's about security.

The difference is that Yarrow is a PRNG that reuses the same 160 bits
of entropy until it reseeds itself. A traditional /dev/random will
output fewer random bits than it get in as interrupt entropy (a good
implementation will be conservative about this). A lot of people
prefer the latter approach for critical things like key generation.

This is just off the top of my head, but for example, say I want to
create a data dvd that's encrypted with a unique keyfile. I may have a
script that starts like this:

  # Create a dvd image file prefilled with random bits
  dd if=/dev/urandom of=./dvd bs=1m count=4480

  # Create a random 512-bit keyfile 
  dd if=/dev/random of=./keyfile bs=64 count=1

With FreeBSD 6.2 both files will be filled by Yarrow and it's likely
that the end of ./dvd and the whole of ./keyfile will come from the
same Yarrow pseudo-random sequence. If enough of the random data
survives at the end of the dvd it may allow an attack against the PRNG.

As things stand, Yarrow is secure, but it might not be a few years from
now.