Problem - Kevin Tafuro

attacks are a realistic threat, you will usually have far bigger threats, and mitigating
those threats will help mitigate this one as well.
There is a lot that can go wrong when using a pseudo-random number generator.
Coming up with a good construct turns out to be the easy part. Here are some things
you should closely consider:
• Pseudo-random number generators need to be seeded with an adequate amount
of entropy; otherwise, they are still potentially predictable. We recommend at
least 80 bits. See the various recipes elsewhere in this chapter for information on
collecting entropy.
• Be careful to pay attention to the maximum number of outputs a generator can
produce before it will need to be reseeded with new entropy. At some point, generators
start to leak information and will generally fall into a cycle. Note,
though, that for the configurations we present, you will probably never need to
worry about the limit in practice. For example, the generator based on AES-128
leaks a bit of information after 264 16-byte blocks of output, and cycles after 2128 such blocks.
• When adding entropy to a system, it is best to collect a lot of entropy and seed
all at once, instead of seeding a little bit at a time. We will illustrate why by
example. Suppose that you seed a generator with one bit of entropy. An attacker
has only one bit to guess, which can be done accurately after two outputs. If the
attacker completely compromises the state after two outputs, and we then add
another bit of entropy, he can once again guess the state easily. If we add one bit
128 times, there is still very little security overall if the generator state is compromised.
However, if you add 128 bits of entropy to the generator all at once, an
attack should essentially be infeasible.
• If an attacker can somehow compromise the internal state of a pseudo-random
number generator, then it might be possible to launch a backtracking attack,
where old generator outputs can be recovered. Such attacks are easy to thwart;
see Recipe 11.6.
In the following three subsections, we will look at three different techniques for
pseudo-random number generators: using a block cipher such as AES, using a stream
cipher directly, and using a cryptographic hash function such as SHA1.
Using generators based on block ciphers
If you are in an environment where you have use of a good block cipher such as AES,
you have the makings of a cryptographically strong pseudo-random number generator.
Many of the encryption modes for turning a block cipher into a stream cipher are
useful for this task, but CTR mode has the nicest properties. Essentially, you create
random outputs one block at a time by encrypting a counter that is incremented after
every encryption operation.
Using an Application-Level Generator | 583
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.