Problem - Kevin Tafuro

Discussion
There are two common reasons why you may want to reseed a PRNG. First, your
threat model may include the possibility of the internal state of your PRNG being
compromised, and you want to prevent against an attacker’s being able to figure out
numbers that were output before the state compromise. Reseeding, if done right,
essentially transforms the internal state in a way that preserves entropy while making
it essentially impossible to backtrack. Protecting against backtracking attacks can
be done cheaply enough, so there is no excuse for not doing it.
Second, you may want to add entropy into the state. This could serve a number of
purposes. For example, you might want to add entropy to the system. Remember,
however, that cryptographic generators have a maximum amount of entropy they
can contain, so adding entropy to a generator state can look unnecessary.
When available, however, reseeding with entropy is a good conservative measure, for
several reasons. For one reason, if you have underestimated the amount of entropy
that a generator has, adding entropy is a good thing. For another, if the generator has
lost any entropy, new entropy can help replenish it. Such entropy loss is natural
because cryptographic algorithms are not as good as their theoretical ideals. In addition,
because we generally do not know the exact strength of our algorithms, it is
hard to determine how quickly entropy gets lost. (Note, however, that if the algorithms
are as strong as believed, it should be quite slowly.)
While a generator based on AES or HMAC-SHA1, implemented as discussed in
Recipe 11.5, probably never loses more than a miniscule amount of entropy before
264 outputs, it is always good to be conservative and assume that it drains quickly,
particularly if you have entropy to spare.
When adding entropy to a system, it is best to collect a lot of entropy
and seed all at once, instead of seeding a little bit at a time. We will
illustrate why by example. Suppose you seed a generator with one bit
of entropy. An attacker has only one bit to guess, which can be done
accurately after two outputs. If the attacker completely compromises
the state after two outputs, and we then add another bit of entropy, he
can once again guess the state easily.
If we add one bit 128 times, there is still very little security overall if
the generator state is compromised. However, if you add 128 bits of
entropy to the generator all at once, an attack should essentially be
infeasible.
The actions you should take to reseed a generator are different depending on
whether you are actually adding entropy to the state of the generator or just trying to
thwart a backtracking attack. However, the first step is the same in both cases.
592 | Chapter 11: Random Numbers
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.