RE: Microsoft .NET PRNG (fwd)

Speaking of RNG's, the following are excerpts from a recent thread on LKML
(original thread at http://lkml.org/lkml/2004/7/22/183, among other places).

-- Snip --

From: Balint Marton ([email protected])
Subject: [PATCH] get_random_bytes returns the same on every boot
Date: 2004-07-22 16:00:12 PST

Hi,

At boot time, get_random_bytes always returns the same random data, as if
there were a constant random seed. For example, if I use the kernel level
ip autoconfiguration with dhcp, the kernel will create a dhcp request
packet with always the same transaction ID. (If you have more than one
computers, and they are booting at the same time, then this is a big
problem)

That happens, because only the primary entropy pool is initialized with
the system time, in function rand_initialize. The secondary pool is only
cleared. In this early stage of booting, there is usually no user
interaction, or usable disk interrupts, so the kernel can't add any real
random bytes to the primary pool. And altough the system time is in the
primary pool, the kernel does not consider it real random data, so you
can't read from the primary pool, before at least a part of it will be
filled with some real randomness (interrupt timing).

Therefore all random data will come from the secondary pool, and the
kernel cannot reseed the secondary pool, because there is no real
randomness in the primary one.

From: David Wagner ([email protected])
Subject: Re: [PATCH] get_random_bytes returns the same on every boot
Date: 2004-08-02 15:50:11 PST

Are there any consequences of this for security?  A number of network
functions call get_random_bytes() to get unguessable numbers; if those
numbers are guessable, security might be compromised.  Note that most init
scripts save randomness state from the last reboot and fill it into the
entropy pool after boot, but before then any callers to get_random_bytes()
might be vulnerable.  Has anyone ever audited all places that call
get_random_bytes() to see if any of them might pose a security exposure
during the window of time between boot and execution of init scripts?
For instance, are TCP sequence numbers, SYN cookies, etc. vulnerable?

-- Snip --

Someone else ran some tests with multiple machines (by checking for DHCPNAK's
when they booted) and found that even after applying a patch to seed the RNG
with that old favourite, time(), several were generating identical "random"
numbers.  So it's not only Microsoft whose RNGs deserve scrutiny.

Peter.