Problem - Kevin Tafuro

about? For example, it is possible to monitor electromagnetic signals coming from a
computer to capture every signal coming from that machine. The CIA has been
known to do this with great success. In such a case, there may be absolutely no
entropy at all without some sort of measures to prevent against such attacks.
Most people are not worried about such a threat model because the attack requires a
high degree of skill. In addition, it generally requires placing another machine in
close proximity to the machine being targeted. A more realistic assumption, is that
someone with a local (nonroot) account on the machine will try to launch an attack.
Quite a bit of the entropy an interactive Unix system typically gathers can be
observed by such an attacker, either directly or indirectly.
If you are not worried about people with access to the local system, we believe you
should at least assume that attackers will somehow find their way onto the same network
segment as the machine that’s collecting entropy. You should therefore assume
that there is little entropy to be had in network traffic that the machine receives,
because other machines on the network may be able to see the same traffic, and even
inject new traffic.
Another threat you might want to consider is the possibility of an attacker’s finding a
way to pollute or destroy one or more entropy sources. For example, suppose you
are using a hardware random number generator. The attacker may not have local
account access and may not have the resources or know-how for an electromagnetic
signal capture attack. However, there may be an easy way to break the physical random
number generator and get it to produce a big string of zeros.
Certainly, you can use FIPS 140 testing as a preventive measure here, as discussed in
Recipe 11.18. However, those tests are not very reliable. You might still want to
assume that entropy sources may not provide any entropy at all.
Such attacks are probably worst-case in most practical systems. You can prevent
against tainted entropy sources by using multiple entropy sources, under the
assumption (which is probably pretty reasonable in practice) that an attacker will not
have the resources to effectively taint more than one source at once.
With such an assumption, you can estimate entropy as if such attacks are not possible,
then subtract out the entropy estimate for the most plentiful entropy source. For
example, suppose that you want to collect a 128-bit seed, and you read keyboard
input and also read separately from a fast hardware random number generator. With
such a metric, you would assume that the hardware source (very likely to be the most
plentiful) is providing no entropy. Therefore, you refuse to believe that you have
enough entropy until your entropy estimate for the keyboard is 128 bits.
You can come up with more liberal metrics. For example, suppose you are collecting
a 128-bit seed. You could have a metric that says you will believe you really have 128
bits of entropy when you have collected at least 160 bits total, where at least 80 of
those bits are from sources other than the fastest source. This is a reasonable metric,
622 | Chapter 11: Random Numbers
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.