O'Reilly - Practical UNIX & Internet Sec... 7015KB

[Chapter 23] 23.8 Picking a Random Seed
3.
This practice was the problem with the Netscape security bug. The problem was that even though
the UNIX operating system API appears to return the current time to the nearest microsecond,
most operating systems have a resolution considerably coarser-usually within one 1/60th of a
second or less. As Kaufman et al point out, if a clock has only 1/60th of a second granularity, and
the intruder knows to the nearest hour at what time the current time was sampled, then there are
only 60x60x60 = 216,000 possible values for the supposedly random seed.
Divulging the seed value itself.
In one case reported by Kaufman et al, and originally discovered by Jeff Schiller of MIT, a
program used the time of day to choose a per-message encryption key. The problem in this case
was that the application included the time that the message was generated in its unencrypted
header of the message.
How do you pick a good random number? Here are some ideas:
1.
2.
3.
4.
Use a genuine source of randomness, such as a radioactive source, static on the FM dial, thermal
noise, or something similar.
Measuring the timing of hard disk drives can be another source of randomness, provided that you
can access the hardware at a sufficiently low level.
Ask the user to type a set of text, and sample the time between keystrokes.
If you get the same amount of time between two keystrokes, throw out the second value; the user
is prob- ably holding down a key and the key is repeating. (This technique is used by PGP as a
source of randomness for its random number generator.)
Monitor the user.
Each time the user presses the keyboard, take the time between the current keypress and the last
keypress, add it to the current random number seed, and hash the result with a cryptographic hash
function. You can also use mouse movements to add still more randomness.
Monitor the computer.
Use readily available, constantly changing information, such as the number of virtual memory
pages that have been paged in, the status of the network, and so forth.
In December 1994, Donald Eastlake, Steve Crocker, and Jeffrey Schiller prepared RFC 1750, which
made many observations about picking seeds for random number generators. Among them:
1.
2.
Avoid relying on the system clock.
Many system clocks are surprisingly non-random. Many clocks which claim to provide accuracy
actually don't, or they don't provide good accuracy all the time.
Don't use Ethernet addresses or hardware serial numbers.
Such numbers are usually "heavily structured" and have "heavily structured subfields." As a result,
one could easily try all of the possible combinations, or guess the value based on the date of
manufacture.
file:///C|/Oreilly Unix etc/O'Reilly Reference Library/networking/puis/ch23_08.htm (2 of 3) [2002-04-12 10:44:54]