Problem - Kevin Tafuro

ecause even if a source does fail completely, you should end up with 80 bits of security
on a 128-bit value, which is generally considered impractical to attack. (Thus,
80-bit symmetric keys are often considered more than good enough for all current
security needs.)
One thing you should do to avoid introducing security problems by
underestimating entropy is aggregate each entropy source independently,
then mash everything together once you have met your output
metric. One big advantage of such a technique is that it simplifies analysis
that can lead to cryptographic assurance. To do this, you can have
a collector for each entropy source. When you need an output, take
the state of each entropy source and combine them somehow.
More concretely, you could use a SHA1 context for each entropy
source. When an output is needed and the metrics are met, you can
get the state of each context, XOR all the states together, and output
that. Of course, remember that in this scenario, you will never have
more entropy than the output size of the hash function.
Now assume that the attacker cannot make a source fail; she can only take measurements
for guessing attacks. We will talk about estimating the amount of entropy in a
piece of data, assuming two different threat models: with the first, the attacker has
local but nonprivileged access to the machine, * and in the second, the attacker has
access to the local network segment.
In the second threat model, assume this attacker can see everything external that
goes on with the application by somehow snooping network traffic. In addition,
assume that the attacker knows all about the operational environment of the
machine on which the application runs. For example, assume that she knows the
operating system, the applications running on the system, approximately when the
machine rebooted, and so on. These assumptions mean that a savvy attacker can
actually figure out a fair amount about the machine’s state from observing network
traffic.
Unfortunately, the first problem we encounter when trying to estimate entropy is
that, while there is an information-theoretic approach to doing so, it is actually ridiculously
difficult to do in practice. Basically, we can model how much entropy is in
data only once we have a complete understanding of that data, as well as a complete
understanding of all possible channels available to an attacker for measuring the
parts of that data that the attacker would not otherwise be able to figure out from
patterns in the data.
* If an attacker already has privileged access to a machine, you probably have more important issues than her
guessing random numbers.
Performing Entropy Estimation and Management | 623
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.