Problem - Kevin Tafuro

you use a seed file, you can just collect entropy at install time, at which point interacting
with the person performing the install is not a problem.
Entropy in timestamps
For every piece of data that you think has entropy, you can try to get additional
entropy by mixing a timestamp into your entropy state, where the timestamp corresponds
to the time at which the data was processed.
One good thing here is that modern processors can generate very high-resolution
timestamps. For example, the x86 RDTSC instruction has granularity related to the
clock speed of the processor. The problem is that the end user often does not see
anywhere near the maximum resolution from a timing source. In particular, processor
clocks are usually running in lockstep with much slower bus clocks, which in
turn are running in lockstep with peripheral clocks. Expert real-world analysis of
event timings modulo these clock multiples suggests that much of this resolution is
not random.
Therefore, you should always assume that your clock samples are no more accurate
than the sampling speed of the input source, not the processor. For example, keyboards
and mice generally use a clock that runs around 1 Khz, a far cry from the
speed of the RDTSC clock.
Another issue with the clock is something known as a back-to-back attack, in which
depending on the details of entropy events, an attacker may be able to force entropy
events to happen at particular moments. For example, back-to-back short network
packets can keep a machine from processing keyboard or mouse interrupts until the
precise time it is done servicing a packet, which a remote attacker can measure by
observing the change in response in the packets he sends.
To solve this problem, assume that you get no entropy when the delta between two
events is close to the interrupt latency time. That works because both network packets
and keystrokes will cause an interrupt. *
Timing data is generally analyzed by examining the difference between two samples.
Generally, the difference between two samples will not be uniformly distributed. For
example, when looking at multiple such deltas, the high-order bits will usually be the
same. The floor of the base 2 logarithm of the delta would be the theoretical maximum
entropy you could get from a single timestamp, measured in bits. For example,
if your delta between two timestamps were, in hex, 0x9B (decimal 155), the maximum
number of bits of entropy you could possibly have is 7, because the log of 155
is about 7.28.
* Some operating systems can mitigate this problem, if supported by the NIC.
Performing Entropy Estimation and Management | 625
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.