Problem - Kevin Tafuro

• If you have to accept data from the network, make sure that it is likely to have
some other entropy beyond the timing, and never estimate more than 2.5 bits of
entropy per packet with a high-resolution clock (i.e., one running in the GHz
range). If your clock has better than millisecond resolution and the processor is
modern, it is probably reasonable to assume a half-bit of entropy on incoming
network packets.
Entropy in a key press
As with any entropy source, when you are trying to get entropy from a key press, you
should try to get entropy by taking a timestamp alongside the key press and estimate
entropy as discussed in the previous subsection.
How much entropy should you count for the actual value of the key itself, though?
Of course, in practice, the answer has to do with how likely an attacker is to guess
the key you are typing. If the attacker knows that the victim is typing War and Peace,
there would be very little entropy (the only entropy would be from mistakes in typing
or time between timestrokes).
If you are not worried about attacks from local users, we believe that a good, conservative
approximation is one bit of entropy per character, if and only if the character
is not identical to the previous character (otherwise, estimate zero). This assumes
that the attacker has a pretty good but not exact idea of the content being typed.
If an attacker who is sending his own data into your entropy infrastructure is part of
your threat model, we think the above metric is too liberal. If your infrastructure is
multiuser, where the users are separated from each other, use a metric similar to the
ones we discussed earlier for dealing with a single tainted data source.
For example, suppose that you collect keystroke data from two users, Alice and Bob.
Keep track of the number of characters Alice types and the number Bob types. Your
estimate as to the number of bits of entropy you have collected should be the minimum
of those two values. That way, if Bob is an attacker, Alice will still have a reasonable
amount of entropy, and vice versa.
If you are worried that an attacker may be feeding you all your input keystrokes, you
should count no entropy, but mix in the key value to your entropy state anyway. In
such a case, it might be reasonable to count a tiny bit of entropy from an associated
timestamp if and only if the keystroke comes from the network. If the attacker may
be local, do not assume there is any entropy.
Entropy in mouse movements
On most operating systems, moving the mouse produces events that give positional
information about the mouse. In some cases, any user on the operating system can
see those events. Therefore, if attacks from local users are in your threat model, you
should not assume any entropy.
Performing Entropy Estimation and Management | 627
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.