Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Another noob question, I know, but something I'm unsure about.

If I somehow magically knew the output of /dev/urandom at any given time, how much would that weaken a given encryption system? Or, perhaps, what kinds of encryption schemes would be most harmed by reducing this randomness?

share|improve this question
add comment

3 Answers

up vote 2 down vote accepted

If you knew the output of /dev/urandom at all times and various keys were generated using /dev/urandom (say SSH/GPG private keys or an SSL certificates), you could in principle quickly (as in much quicker than brute-force) recreate a keypair by attempting using various states of /dev/urandom. This would effectively bypass all the security methods in place (file encryption; https; data integrity protections) that are based on those now broken keys (this attack is exactly identical to obtaining someone's private keys/certificates).

There are various other things that rely on /dev/urandom that could also break. For example, you could complete a TCP handshake from a IP address you do not control to a server with a cracked /dev/urandom as you could send a SYN, and then send an ACK and guess the server's sequence number.

Granted unless you have compromised a system to replace /dev/urandom with something else (or recorded the bits of /dev/random prior to using them), urandom is not entirely deterministic. /dev/urandom will default to using entropy collected from various hardware components and only fall back to a pseudo-random generator when more entropy is needed than has been collected.

share|improve this answer
add comment

Your question is funny, I'm curious to know how did you came to wonder that /dev/urandom could be predicted.

But more than that, this raise an interesting flaw, as Wikipedia mention it :

In 2004, Landon Curt Noll, Simon Cooper, and Mel Pleasant tested a variety of random number generators, including the /dev/random implementations in FreeBSD 5.2.1, Linux 2.4.21-20, Solaris 8 patch 108528-18, and Mac OS X 10.3.5.[7] They indicated that none of these /dev/random implementations were cryptographically secure because their outputs had uniformity flaws.

That said, I think it answers pretty well your question:

How much would that weaken a given encryption system?

I can't say how much, but I can say it would impact them significantly enough to not consider them as totally secure, because "none of these /dev/random implementations were cryptographically secure".

share|improve this answer
add comment

Obvious answer: If your encryption is directly using the output of dev/urandom, then evaesdroppers will know yor key and then can decrypt your ciphertext as you do with your key. Of course they also need to know the initialization vector, which is also usually generated from the output of dev/urandom.

Well, there are lots of encryption schemes but if your key is relying on dev/urandom, then all of these schemes will be affected if the attacker knows the output of your dev/urandom but I don't know how to "measure the strength" of encryption schemes. I think a cryptalanyst can answer it.

About the randomness of Linux RNGs, there's a paper presented at an IEEE conference: http://eprint.iacr.org/2006/086.pdf The security holes and possible attacks are discussed here. According to their study, dev/random and dev/urandom are not "that much" secure.

On the other hand, dev/random and dev/urandom may pass randomness tests but the true randomness can only be obtained from quantum mechanics: http://www.idquantique.com/true-random-number-generator/products-overview.html

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.