Myths about /dev/urandom (2014)

Half the entropy is trying to figure out which pieces of this article's text are supposed to be the silly falsehoods being corrected, and which pieces are just the second or third paragraph of a preceding 'Fact'. Deadpool is easier to follow.

This is a good place as any to ask, last time I didn't get any answer: has there ever been a serious Linux exploit from manipulating/predicting bad PRNG? Apart from the Debian SSH key generation fiasco from years ago, of course.

Having a good entropy source makes mathematical sense, and you want something a bit more "random" than a dice roll, but I wonder at which point it becomes security theatre.

Of all the possible avenues for exploiting a modern OS might have, I figure kernel PRNG prediction to be very, very far down the list of things to try.

Original discussion from 2014:

* https://news.ycombinator.com/item?id=7359992

Also:

2020: https://news.ycombinator.com/item?id=22683627

2018: https://news.ycombinator.com/item?id=17779657

2017: https://news.ycombinator.com/item?id=13332741

2015: https://news.ycombinator.com/item?id=10149019

Back in the dinosaur days (around 2005) I was working on a PHP CMS used by a big registrar. Occasionally page loads would block for seconds. It appeared randomly (natch) and was relatively unreproducible.

I couldn’t find any good way to debug it and a friend suggested GDB. I had never thought of using such a low level debugger on a scripting language, but what choice did I have? Fired it up, found a blocked process and sure enough it was blocked on reads to /dev/random.

I leaned two things that day: the decision to make and keep /dev/random blocking was dumb and GDB (or lldb, or valgrind, etc.) is useful for debugging just about anything.

That was hard to tell where the additional commentary on the fact ended and the next myth started.

I woke up around 4am, read this, and wondered if I was still in a dream state given the meandering nature of it.

Were the man page musings written in response to the (alleged, but... uh... NSA) kleptographic backdoor in Dual_EC_DRBG? It requires multiple successive outputs to compromise and derive internal PRNG state, if memory serves.

In that one construction, /dev/random blocking on seeding would have a mild state-hiding advantage over /dev/urandom, I imagine... but, sheesh. Nobody use that generator.

Twelve years later, if there's still so much misconception about /dev/(u)random, has the man page been fixed?

Edit: can't count.

(2014)

[flagged]