Loophole in Windows Random Number Generator 305
Invisible Pink Unicorn writes "A security loophole in the pseudo-random number generator used by Windows was recently detailed in a paper presented by researchers at the University of Haifa. The team found a way to decipher how the number generator works, and thus compute previous and future encryption keys used by the computer, and eavesdrop on private communication. Their conclusion is that Microsoft needs to improve the way it encodes information. They recommend that Microsoft publish the code of their random number generators as well as of other elements of the Windows security system to enable computer security experts outside Microsoft to evaluate their effectiveness. Although they only checked Windows 2000, they assume that XP and Vista use similar random number generators and may also be vulnerable. The full text of the paper is available in PDF format."
31784 (Score:5, Funny)
Re: (Score:3, Funny)
Damn you Johnny Two-Tone!
Ummm.... Re:31784 (Score:2, Informative)
Re: (Score:3, Funny)
Oh, wait, that was Landru.
NSA access? (Score:3, Informative)
Is that the NSA secret surveillance access [heise.de]?
--
U.S. Government corruption TimeLines [cooperativeresearch.org]
Example: Complete 911 Timeline, 3895 events
Re: (Score:3, Informative)
As John von Neumann joked, "Anyone who considers arithmetical methods of producing random digits is, of course, in a state of sin."
Re: (Score:3, Informative)
On mistaking pseudorandom number generators for being truly "random" -- this quote is often erroneously interpreted to mean that von Neumann was against the use of pseudorandom numbers, when in reality he was cautioning about misunderstanding their true nature while advocating their use. From "Various techniques used in connection with random digits" by John von Neumann in Monte Carlo Method (1951) edited by A.S. Householder, G.E. Forsythe, and H.H. Germond [wikiquote.org]
Sounds pretty reasonable, or a very long lasting urban legend...
Comment removed (Score:4, Interesting)
Re:Hardware RNG (Score:5, Insightful)
Re:Hardware RNG (Score:5, Funny)
After all, they spent so much time perfecting it in Excel 2007!
Re:Hardware RNG (Score:4, Insightful)
Re:Hardware RNG (Score:4, Insightful)
Re:Hardware RNG (Score:5, Funny)
"Hey guys, I dont think the random number generator is random enough today - it came up with 2 prime numbers in a row! Anyone feel like taking a few days to rewrite it, test it, introduce a few bugs, document it, seal off the documentation to make sure nobody finds it, and go take it up to Steve? I hear he's out of chairs right now so it should be okay".
Re:Hardware RNG (Score:4, Interesting)
If they had time in between cocking up all the WGA stuff, that is.
Re: (Score:3, Interesting)
Look at it from a business perspective, microsoft will.
Re:Hardware RNG (Score:5, Insightful)
Re:Hardware RNG (Score:5, Funny)
Okay, module 14537r Random Number Generator. Teams, who wants do do this ? No, it's not boring. Come on. Okay, draw straws. Jones, you win. Yes, sure you can get the intern to write it. You carry on with the Clippy enhancements.
Why should MS crypto programmers be aware? (Score:3, Insightful)
Now I don't know what the crypto folk are like, but I have yet to see any real evidence to suggest that they'd be any better.
Re:Hardware RNG (Score:5, Funny)
Re: (Score:3, Funny)
Re:Hardware RNG (Score:5, Funny)
the number of affected users enbiggens the problem (Score:5, Insightful)
Re:Hardware RNG (Score:5, Insightful)
You could probably even slip a little bias in there without being called a troll with:
Of course, it would be a little silly to assume that this does not affect at least XP, as 2000 was still under maintenance when XP was released, so if the bug was found during the development of XP, it should have been fixed in 2000. It would look far worse for Microsoft if they KNEW about a security hole in 2000 while it was still under maintanace, and did not bother to back port the fix from XP.
Why bother! (Score:2)
Re: (Score:3, Funny)
Re: (Score:3, Insightful)
Dates below 70 are considered in the year 2000, over 70 are considered in the 1900s.
Excel also has some stupid bugs to do with dates, which microsoft are now trying to enshrine in the ooxml format.
Re: (Score:3, Informative)
Maybe you should read some formal documentation before posting.
sigh
Re: (Score:2)
We analyze the way in which the operating system uses the WRNG and note that a different copy of the WRNG is run, in user-mode, for every process, and that typical invocations of the WRNG are seldom refreshed with additional entropy. Therefore, the backward and forward security attacks, which only work while there is no entropy based rekeying, are highly effective. Furthermore, we also found that part of the state of the generator is initialized with values that are rather predictable.
Re:Hardware RNG (Score:5, Informative)
Any good RNG combines sources of entropy with a cryptographically secure PRNG. The researchers are attacking the PRNG portion of the Windows RNG. If you only generate keys (or other random numbers) infrequently, this is a non-issue, as the hardware sources of entropy provide enough "really random" bits to generate a "really random" number.
However, if you generate a fast series of keys (or other random numbers), you quickly use up all of the "really random" bits that the RNG has cached, and you only have the PRNG on your side, and therefor the key is merely "pseudo random". TFA is an attack on the "psuedo random" portion of the Windows RNG.
Interestingly, the much-reviewed TrueCrypt engine seems to slow to a crawl if you create a bunch of files (and therefore keys) in a hurry - presumably it has an RNG that actually blocks waiting until it has enough new "really random" bits for each new key. This is a cool idea for a crypto library, but not usable for a general-purpose RNG, which suggests that the system libraries should probably provide *two* RNGs.
Re:Hardware RNG (Score:4, Funny)
Re: (Score:3, Informative)
http://en.wikipedia.org/wiki/Urandom [wikipedia.org]
Re: (Score:3, Informative)
Interestingly, the much-reviewed TrueCrypt engine seems to slow to a crawl if you create a bunch of files (and therefore keys) in a hurry - presumably it has an RNG that actually blocks waiting until it has enough new "really random" bits for each new key.
This isn't how TC behaves on Linux at all, and I would doubt that description anyway. Generating new keys as files are written? I don't think so.
Re: (Score:3, Funny)
Like a strong Brownian motion producer (say, a cup of hot tea)?
Beef.
Re: (Score:3, Funny)
Re: (Score:2)
Seed time (Score:3, Interesting)
Re:Seed time (Score:5, Informative)
Re: (Score:2)
Re: (Score:2)
Huh? (Score:3, Insightful)
Maybe it's just me, but I didn't think anyone would be stupid enough to use rand for SSL like the article is implying.
From what I can see, this is an old article anyway.
Re:Huh? (Score:4, Informative)
Re:Huh? (Score:5, Informative)
Re:Huh? (Score:5, Funny)
Date: received 4 Nov 2007
Old indeed. 8 days. That's a lot, Microsoft might have already fixed it, you see, they fix things fast!
Re: (Score:2)
Re: (Score:2)
Re: (Score:2, Funny)
Where's the white noise generator? (Score:5, Interesting)
Put white noise hardware and real random number hardware on PCs, and this whole problem goes away.
Re: (Score:2)
Re:Where's the white noise generator? (Score:4, Informative)
Some AMD64 chipsets still do though. You generally don't find hardware RNG on any chipset below the "Major Enterprise Purchase" mark.
Which could be bettered, easily.
Re:Where's the white noise generator? (Score:5, Funny)
A white noise generator? Bah... What systems need are pop-o-matic bubbles with m * 2^n sided dice to generate m * n bits. It could even put a window up saying, "The entropy pool is depleted. Please press the pop-o-matic bubble to generate more."
That would be awesome
Re:Where's the white noise generator? (Score:5, Funny)
Re: (Score:3, Informative)
Re:Where's the white noise generator? (Score:5, Informative)
Re: (Score:2)
How do these work? Electromagnetics? Background radiation? Quantum unknowns? Even without being a physicist, I can imagine flaws in systems based on most of these.
Re: (Score:2, Informative)
http://en.wikipedia.org/wiki/Thermal_noise [wikipedia.org]
Re: (Score:2, Informative)
Shot noise in diodes under reverse breakdown is a typical way to generate noise.
Re: (Score:3, Informative)
Re: (Score:2)
I've seen software that tracks mouse movements for a while when generating random numbers, couldn't something similar be done through the OS itself? Couldn't you use mouse movement, keyboard input, sound and video output, etc. as your RNG? Wouldn't that be almost as good as a truly random number generator?
Or is there some obvious flaw in such a scheme which keeps it from being
Re: (Score:2)
USB Hardware RND (Score:5, Interesting)
I got the idea from a project that used a webcam snapping pictures of a Lava Lamp® as a hardware RNG.
Re: (Score:3, Interesting)
That was a decade ago though. Modern chips might be a lot more uniform. Also, a digital camera on your desktop is unlikely to be liquid nitrogen cooled, so the thermal noise will be higher anyway.
The Vista RNG (Score:5, Funny)
Your system must meet the requirements to be able to run the Windows Random Number Generator on Vista. Otherwise, you will need to use Windows Number Generator Basic. The only number WNGB can generate is 4.
Re:The Vista RNG (Score:5, Funny)
Re: (Score:2)
ob XKCD reference (Score:5, Funny)
http://xkcd.com/221/ [xkcd.com]
Re:The Vista RNG (Score:5, Informative)
Win 2K is a very legacy product and its crypto functionality is very limited compared to 2K3 and Vista.
Re: (Score:2, Troll)
> of Win 2000.
You know this, of course, because you have reviewed the source code.
Re:The Vista RNG (Score:5, Interesting)
Re: (Score:3, Insightful)
Novell (Score:5, Funny)
What is the scope of potential attacks? (Score:2)
Spearmen (Score:2, Funny)
Fixed in Vista? (Score:5, Insightful)
Re:Fixed in Vista? (Score:5, Informative)
http://www.microsoft.com/technet/archive/security/topics/issues/fipseval.mspx?mfr=true [microsoft.com]
You'll note that Windows 2000 passed FIPS-140-1.
Re:Fixed in Vista? (Score:4, Interesting)
Publication iffy (Score:4, Insightful)
If both of these did not happen, especially if (b) didn't happen, what you would be doing is exposing all non-upgrading users to the full brunt of whatever flaws their might be. Would this really be productive? Does this remind you of various failures in Linux code that led to rootkits being developed for it. Did the victims of such attacks think it was all for the best because they didn't upgrade in a timely manner?
Yes, relying on people not reverse-engineering code to protect users isn't a great plan. But the current situation - as regrettable as it is - is this is the only plan. There are no fallbacks, there are no alternatives. Most of the running copies of Windows aren't going to be "fixed" in any way whatsoever.
Re: (Score:3, Informative)
Does this mean... (Score:5, Funny)
Don't newer cpus have TRNG builtin? (Score:2)
Re: (Score:2)
You're slightly mistaken.
Intel only provided RNG on the 810 series of chipsets, and that was the Pentium 3 generation. The VIA C3 is of the same generation of chipsets, nothing faster than a 1.4 ghz processor. AMD does provide a path, but it's an optional part of the chipset, and not universally supported.
There used to be more ubiquitous hardware RNG.
Here's the thinking in Redmont (Score:2)
Similar but different? (Score:4, Interesting)
Re: (Score:2)
Is there a list of slots machines that run windows (Score:5, Funny)
Solution (Score:2)
Hardware RNG (Score:5, Interesting)
Vista is safe! (Score:2)
Oblig Dilbert (Score:2)
Dilbert: "Are you sure that is random?"
Troll: "That's the thing with random numbers, you can never be sure... nine,nine,nine,nine,nine..."
Might not extend past W2K (Score:3, Insightful)
1) This does not affect current versions of Windows.
2) This only affects exported versions of Windows. (The PRNG may still be there but may not be default.)
The RC4 implementation screams of a bit-size issue. It also goes to reason since they are in a non-US country. Furthermore, I doubt this affects current versions based on the information available. If you want, go throw the CMVP RNG validation list [nist.gov] and find the Microsoft certificates. All of the RNGs that are approved do not use RC4.
I believe there is a lot of hot-air and presumption and in the paper. They published findings and ASSUMED that nothing has been changed with relation to the PRNG. The algorithm certificates shown above clearly shows this is not the case. Furthermore, they do not state which cryptographic provider is used to perform the generation. I believe this PRNG might be from DSS_BASE, which has since been deprecated. This would mean the problem does not exist. They also ask for Microsoft's code, yet I see none of their own. Without their code, how can their paper be reasonably verified.
I say show me some more, before you cry that this is the way all PRNGs since W2K have been implemented.
Not so severe (Score:5, Informative)
The bottom line is that every process has its own copy of the RNG state. That means that breaking into one process will not help you deduce the random numbers being used by another. (The authors comment that there may be similarities between the two states, but they don't have any way to turn that into a practical attack.) So the only thing this does is it lets an attacker who compromises a certain process or program, such as IE, be able to learn the random number state. From that he can deduce old random numbers that were used, as well as deduce new random numbers that will be created in the future.
That second part is hard to avoid, but the first part, running the state backward (confusingly called forward security by cryptographers), is a sign of bad design of the RNG. Okay, Microsoft messed that up. But what are the security implications?
The implication is that if someone breaks into your computer, here is something more he can do. Not only can he take over going forward, he can learn a certain amount of data about the past. If you had an SSL protected session in the past, then he could go back and figure out what they keys were back then and decrypt the data.
But how bad is this, really? Compared to the harm he can already do by breaking into your computer? Given that he's there, he can learn all of your future SSL keys anyway. Anywhere you go in the future, your bank, paypal, ebay, any site he can learn all of your passwords and account numbers. He doesn't need to compromise the RNG for this, he can just watch your keystrokes. Basically, you are totally screwed if this happens.
Given the enormous magnitude of the security lost, the additional harm from being able to decrypt a few old requests is quite small. You are basically owned from then on. If you have insecure software that is vulnerable to such attacks, you're screwed anyway. A weakness in the RNG state means you are slightly more screwed, that's all. It's not a major change in the security equation.
The bottom line is that most of the damage comes from the break-in. Again, not to take anything away from these guys' work, but the attack they describe is at worst just the icing on a very nasty cake. Microsoft should fix it, and it sounds like they probably have in Vista, but nobody needs to change their security practices because of this flaw.
Re: (Score:3, Funny)
I can't believe this is an issue... (Score:3, Informative)
One of the fundamental tenets of good cryptography is that if you can't see the algorithm, then it is not secure. That means all of the algorithm, including the RNG, if you use one. If you can't cryptanalyze it, you can't make any judgements about security. The fact that the Windows RNG is closed source and proprietary automatically excludes it from use in cryptographic functionality, and I'm quite surprised to discover that it is actually being used this way. (Actually, I'm not surprised; I'm surprised that some people consider it secure.)
And after the various faults with RNGs in the past on UNIX and Mainframes, I'm surprised that anyone is so naive as to believe that Windows had a good one. Microsoft's past history is so poor that only the most naive of programmers would assume that their RNG could be used for security purposes. It might be fine for simulations and gaming purposes, but that's it.
Considering that any cryptographer worth a Google search would know that almost all PRNG's have been broken, I'm wondering why anyone is making an issue of this; I thought all cryptographers just assumed that the host OS RNG is insecure by default. Or could it be that we have a lot more naive Windows developers than previously thought?
Tin foil hat: "Reflections on Trusting Trust" (Score:3, Insightful)
I honestly have 100% no doubts that "Microsoft" is purposely installing multitudes of access methodologies in the form of bugs with "plausible deniability" for U.S. security officials. The telco's do it, they've been caught and are now asking for immunity. Now whether or not is is actually "Microsoft," or people working within the company secretly for the various security agencies purposely inserting these nearly impossible to find bugs is a different question.
Call me paranoid, but if I told you there was a secret room through which all internet traffic gets directed in all the major internet NOCs, you'd call that paranoid as well.
Re: (Score:3, Insightful)
The Common Criteria evaluators have essentially full access to the Windows source code and all supporting documentation. They look for issues that would enable backdoors or security vulnerabilities. Once and a while, they find something interesting. Microsoft then fixes it as a security bug.
Windows platforms are used by numerous
Re: (Score:3, Insightful)
I have never heard anything other than, "It could be, if you knew...."
The Common Criteria evaluators have essentially full access to the Windows source code and all supporting documentation. They look for issues that would enable backdoors or security vulnerabilities. Once and a while, they find something interesting. Microsoft then fixes it as a security bug.
Funny how people who are not "Common Criteria eva
O(2^23)=O(1) (Score:3, Informative)
Re: (Score:2)
Re: (Score:2, Informative)
Re: (Score:3, Informative)
Unfortunately extra non-determinism would be introduced by bones files, and you'd get a new random sequence if you logged out. The server ad
Re: (Score:2)
Although they only checked Windows 2000, they assume that XP and Vista use similar random number generators and may also be vulnerable. The full text of the paper is available in PDF format."
And what happens when we make assumptions? we make an ass of me, and you make more money [google.com]
Uh, no... When you make an assumption, you make an ass of you and Mption...