Problem - Kevin Tafuro

Discussion
FIPS 140 tests are useful for proving that a stream of random numbers
are weak, but the tests don’t demonstrate at all when the numbers are
good. In particular, it is incredibly easy to have a weak generator yet
still pass FIPS tests by processing data with a cryptographic primitive
like SHA1 before running the tests. FIPS 140 is only useful as a safety
net, for when an entropy source you think is strong turns out not to be.
FIPS 140 is a standard authored by the U.S. National Institute of Standards and
Technology (NIST; see http://csrc.nist.gov/cryptval/). The standard details general
security requirements for cryptographic software deployed in government systems
(primarily cryptographic “providers”). There are many aspects to the FIPS 140 standard,
one of which is a set of tests that all entropy harvesters and pseudo-random
number generators must be able to run to achieve certification.
FIPS 140-1 was the original standard and had several tests for random number
sources; most of these occurred on startup, but one occurred continuously. Those
tests only needed to be implemented for the two highest levels of FIPS compliance
(Levels 3 and 4), which few applications sought.
In FIPS 140-2, only a single test from FIPS 140-1 remains. This test is mandatory any
time a random number generator or entropy source is used.
Although the FIPS 140-1 standard is being obsoleted by 140-2, it is important to note
that a module can routinely fail the FIPS 140-1 tests and still be FIPS 140-1 compliant.
For Level 3 compliance, the user must be able to run the tests on command, and
if the tests fail, the module must go into an error state. For Level 4 compliance, the
module must comply with the requirements of Level 3, plus the tests must be run at
“power-up.” A weak random number generator, such as the one implemented by the
standard C library function rand( ), should be able to get Level 3 certification easily.
FIPS 140-1 testing is a reasonable tool for ensuring that entropy sources are producing
quality data, if those entropy sources are not using any cryptographic operations
internally. If they are, the entropy source will almost certainly pass these tests, even if
it is a very poor entropy source. For the same reason, this set of tests is not good for
testing cryptographic PRNGs, because all such generators will pass these tests with
ease, even if they are poor. For example, simply hashing an incrementing counter
that starts at zero using MD5 will produce a data stream that passes these tests, even
though the data in that stream is easily predictable.
FIPS 140-2 testing generally is not very effective unless a failed hardware device starts
producing a repeating pattern (e.g., a string of zero bits). The FIPS 140-2 test consists
of comparing consecutive generator outputs (on a large boundary size; see the
next section). If your “random number generator” consists only of an ever-incrementing
128-bit counter, you will never fail this test.
616 | Chapter 11: Random Numbers
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.