random numbers and file transfers

Hi,

if you want to use your NetMD device as a random number generator, try this:

=> 00 18 00 08 00 46 f0 03 01 03 20 ff 00 00 00 00 00 00 00 00 00 00 00 00
<= 09 18 00 08 00 46 f0 03 01 03 20 00 00 00 00 21 a0 3d 0e f8 3f af 54
=> 00 18 00 08 00 46 f0 03 01 03 20 ff 00 00 00 00 00 00 00 00 00 00 00 00
<= 09 18 00 08 00 46 f0 03 01 03 20 00 00 00 00 31 9c f2 97 92 ce 08 a0
=> 00 18 00 08 00 46 f0 03 01 03 20 ff 00 00 00 00 00 00 00 00 00 00 00 00
<= 09 18 00 08 00 46 f0 03 01 03 20 00 00 00 00 0a d4 cc c6 21 d0 24 2d
=> 00 18 00 08 00 46 f0 03 01 03 20 ff 00 00 00 00 00 00 00 00 00 00 00 00
<= 09 18 00 08 00 46 f0 03 01 03 20 00 00 00 00 20 4f 5d 65 61 67 e7 4b
=> 00 18 00 08 00 46 f0 03 01 03 20 ff 00 00 00 00 00 00 00 00 00 00 00 00
<= 09 18 00 08 00 46 f0 03 01 03 20 00 00 00 00 43 be 5d 14 a8 c9 bb 01

Of course what really happens is that the program sends something like

=> 00 18 00 08 00 46 f0 03 01 03 20 ff 00 00 00 00 XX XX XX XX XX XX XX XX

So the program sends a 64 bit number and receives a 64 bit in return, which
is different in each run.  This is a challenge - response ritual.  Pulling
out the battery doesn't visible reset the state, so either some info about
the state is stored in the eeprom, or the running time from power on enters
the equation (I can not think of many other entropy sources in the player).
In anyway, it is extremely unlikely that the player can collect good entropy
that fast as it does, so the randomness of the above numbers will be weak.
This leaves two possibilities:

1. The random calculator is deterministic, ie, it is pseudo random.
   Then there are good chances that the algorithm can be revealed by a
   careful analysis of the random sequences.  If someone has fun studying
   that by checking out the distribution, etc, that would be great.

2. The randomness in fact depends on run time since power on or other
   indeterministic factors.  Although it would still be weak from a
   cryptographical point of view, it would be good enough to make it
   difficult for us to make good use of this weakness.

I don't really think we need to know the algorithm, although it would be
nice to be able to set the random generator into any arbitrary state (we
could probably use that in further analysis).  What I still expect is that
we can simply use some windows dll to perform the encryption.  Still, what
the above likely means is that you _can not_ replay sniffed file transfers,
not even to the same player (if we could analyse the random number generator
we could)[1].  This will make it harder for us.

Thanks,
Marcus

[1] I don't know if the player would reject such a transfer, or if the
result would be noise.  We will find out.

-- 
`Rhubarb is no Egyptian god.' GNU      http://www.gnu.org    [email protected]
Marcus Brinkmann              The Hurd http://www.gnu.org/software/hurd/
[email protected]
http://www.marcus-brinkmann.de/