Loophole in Windows Random Number Generator 305
Invisible Pink Unicorn writes "A security loophole in the pseudo-random number generator used by Windows was recently detailed in a paper presented by researchers at the University of Haifa. The team found a way to decipher how the number generator works, and thus compute previous and future encryption keys used by the computer, and eavesdrop on private communication. Their conclusion is that Microsoft needs to improve the way it encodes information. They recommend that Microsoft publish the code of their random number generators as well as of other elements of the Windows security system to enable computer security experts outside Microsoft to evaluate their effectiveness. Although they only checked Windows 2000, they assume that XP and Vista use similar random number generators and may also be vulnerable. The full text of the paper is available in PDF format."
Re:Huh? (Score:4, Informative)
Re:Huh? (Score:5, Informative)
Re:Yes, actually. The cat does "got my tongue." (Score:2, Informative)
Re:Seed time (Score:5, Informative)
Re:Where's the white noise generator? (Score:4, Informative)
Some AMD64 chipsets still do though. You generally don't find hardware RNG on any chipset below the "Major Enterprise Purchase" mark.
Which could be bettered, easily.
Re:Fixed in Vista? (Score:5, Informative)
http://www.microsoft.com/technet/archive/security/topics/issues/fipseval.mspx?mfr=true [microsoft.com]
You'll note that Windows 2000 passed FIPS-140-1.
Re:Where's the white noise generator? (Score:3, Informative)
Re:Yes, actually. The cat does "got my tongue." (Score:3, Informative)
Unfortunately extra non-determinism would be introduced by bones files, and you'd get a new random sequence if you logged out. The server admin could also stop this attack quite easily by sourcing random data (or just the seed) from
Re:Where's the white noise generator? (Score:5, Informative)
Re:The Vista RNG (Score:5, Informative)
Win 2K is a very legacy product and its crypto functionality is very limited compared to 2K3 and Vista.
Ummm.... Re:31784 (Score:2, Informative)
Re:Where's the white noise generator? (Score:2, Informative)
http://en.wikipedia.org/wiki/Thermal_noise [wikipedia.org]
Re:Publication iffy (Score:3, Informative)
Re:Where's the white noise generator? (Score:2, Informative)
Shot noise in diodes under reverse breakdown is a typical way to generate noise.
Re:Pluggable Cryptomodules (Score:1, Informative)
Well your wish has been granted. The Windows Vista cryptography API (CNG) provides just this kind of functionality.
From the MSDN page on CNG features [microsoft.com]:
It seems that the CNG is very extensible. You can add new RNGs, encryption providers, hashing algorithms, etc.
Re:Hardware RNG (Score:5, Informative)
Any good RNG combines sources of entropy with a cryptographically secure PRNG. The researchers are attacking the PRNG portion of the Windows RNG. If you only generate keys (or other random numbers) infrequently, this is a non-issue, as the hardware sources of entropy provide enough "really random" bits to generate a "really random" number.
However, if you generate a fast series of keys (or other random numbers), you quickly use up all of the "really random" bits that the RNG has cached, and you only have the PRNG on your side, and therefor the key is merely "pseudo random". TFA is an attack on the "psuedo random" portion of the Windows RNG.
Interestingly, the much-reviewed TrueCrypt engine seems to slow to a crawl if you create a bunch of files (and therefore keys) in a hurry - presumably it has an RNG that actually blocks waiting until it has enough new "really random" bits for each new key. This is a cool idea for a crypto library, but not usable for a general-purpose RNG, which suggests that the system libraries should probably provide *two* RNGs.
Re:Hardware RNG (Score:3, Informative)
http://en.wikipedia.org/wiki/Urandom [wikipedia.org]
Re:Where's the white noise generator? (Score:3, Informative)
Not so severe (Score:5, Informative)
The bottom line is that every process has its own copy of the RNG state. That means that breaking into one process will not help you deduce the random numbers being used by another. (The authors comment that there may be similarities between the two states, but they don't have any way to turn that into a practical attack.) So the only thing this does is it lets an attacker who compromises a certain process or program, such as IE, be able to learn the random number state. From that he can deduce old random numbers that were used, as well as deduce new random numbers that will be created in the future.
That second part is hard to avoid, but the first part, running the state backward (confusingly called forward security by cryptographers), is a sign of bad design of the RNG. Okay, Microsoft messed that up. But what are the security implications?
The implication is that if someone breaks into your computer, here is something more he can do. Not only can he take over going forward, he can learn a certain amount of data about the past. If you had an SSL protected session in the past, then he could go back and figure out what they keys were back then and decrypt the data.
But how bad is this, really? Compared to the harm he can already do by breaking into your computer? Given that he's there, he can learn all of your future SSL keys anyway. Anywhere you go in the future, your bank, paypal, ebay, any site he can learn all of your passwords and account numbers. He doesn't need to compromise the RNG for this, he can just watch your keystrokes. Basically, you are totally screwed if this happens.
Given the enormous magnitude of the security lost, the additional harm from being able to decrypt a few old requests is quite small. You are basically owned from then on. If you have insecure software that is vulnerable to such attacks, you're screwed anyway. A weakness in the RNG state means you are slightly more screwed, that's all. It's not a major change in the security equation.
The bottom line is that most of the damage comes from the break-in. Again, not to take anything away from these guys' work, but the attack they describe is at worst just the icing on a very nasty cake. Microsoft should fix it, and it sounds like they probably have in Vista, but nobody needs to change their security practices because of this flaw.
NSA access? (Score:3, Informative)
Is that the NSA secret surveillance access [heise.de]?
--
U.S. Government corruption TimeLines [cooperativeresearch.org]
Example: Complete 911 Timeline, 3895 events
Re:31784 (Score:3, Informative)
As John von Neumann joked, "Anyone who considers arithmetical methods of producing random digits is, of course, in a state of sin."
I can't believe this is an issue... (Score:3, Informative)
One of the fundamental tenets of good cryptography is that if you can't see the algorithm, then it is not secure. That means all of the algorithm, including the RNG, if you use one. If you can't cryptanalyze it, you can't make any judgements about security. The fact that the Windows RNG is closed source and proprietary automatically excludes it from use in cryptographic functionality, and I'm quite surprised to discover that it is actually being used this way. (Actually, I'm not surprised; I'm surprised that some people consider it secure.)
And after the various faults with RNGs in the past on UNIX and Mainframes, I'm surprised that anyone is so naive as to believe that Windows had a good one. Microsoft's past history is so poor that only the most naive of programmers would assume that their RNG could be used for security purposes. It might be fine for simulations and gaming purposes, but that's it.
Considering that any cryptographer worth a Google search would know that almost all PRNG's have been broken, I'm wondering why anyone is making an issue of this; I thought all cryptographers just assumed that the host OS RNG is insecure by default. Or could it be that we have a lot more naive Windows developers than previously thought?
Re:Hardware RNG (Score:1, Informative)
The big problem that I see is, that it seems that Microsoft did not give the correct implementation of PRNG the importance it should have.
Re:Hardware RNG (Score:3, Informative)
Maybe you should read some formal documentation before posting.
sigh
Re:Hardware RNG (Score:3, Informative)
O(2^23)=O(1) (Score:3, Informative)
Re:Not so severe (Score:1, Informative)
Re:31784 (Score:3, Informative)