Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

According to findings by the EFF's SSL observatory, there are "tens of thousands of keys that offer effectively no security due to weak random number generation algorithm." My understanding of that problem is this: During the generation the large prime factors used by the RSA algorithm, a significant number of devices ended up choosing the same prime factors. Presumably this occurred because insufficient entropy was used by the devices to select the prime factors.

When you install Active Directory Certificate Services, you are presented with the following screen:

enter image description here

Ostensibly, completing the installation causes the generation of the prime factors that comprise the key pair.

I have often heard the recommendation (here's one) to create your root certificate authority as a virtual machine to ease taking it offline and physically securing it. In a Windows Environment, it seems natural to host your root CA using Hyper-V.

This then raises the following questions:

  1. Where does a HyperV-hosted instance of Windows Server get its entropy when generating the prime factors during AD Certificate Services installation?

  2. How 'good' is the entropy source?

share|improve this question

1 Answer 1

A Hyper-V guest gets its entropy just like it would if it wasn't a guest. For Windows, an application that uses Microsoft's cryptographic service providers get its entropy from three/four main sources:

  1. External events like network activity.
  2. Details about the callers to the CSP functions (process ID, thread ID, various timers associated with those threads and processes, etc.).
  3. Any entropy the application developer would like to provide (key press timings, mouse movement, etc.).
  4. Any supported hardware entropy devices, such as RdRand in Intel processors.

All four of the above are just as available to a guest as they would be if it were a physical server.

As described in msdn.microsoft.com/en-us/library/windows/desktop/aa379942(v=vs.85).aspx:

With Microsoft CSPs, CryptGenRandom uses the same random number generator used by other security components. This allows numerous processes to contribute to a system-wide seed. CryptoAPI stores an intermediate random seed with every user. To form the seed for the random number generator, a calling application supplies bits it might have—for instance, mouse or keyboard timing input—that are then combined with both the stored seed and various system data and user data such as the process ID and thread ID, the system clock, the system time, the system counter, memory status, free disk clusters, the hashed user environment block. This result is used to seed the pseudorandom number generator (PRNG). In Windows Vista with Service Pack 1 (SP1) and later, an implementation of the AES counter-mode based PRNG specified in NIST Special Publication 800-90 is used. In Windows Vista, Windows Storage Server 2003, and Windows XP, the PRNG specified in Federal Information Processing Standard (FIPS) 186-2 is used. If an application has access to a good random source, it can fill the pbBuffer buffer with some random data before calling CryptGenRandom. The CSP then uses this data to further randomize its internal seed. It is acceptable to omit the step of initializing the pbBuffer buffer before calling CryptGenRandom.

share|improve this answer
    
Do you have a source for your point (4)? The link you provided does not support it. –  alx9r Mar 11 at 16:16
    
Also, do you have a source supporting the general availability of RdRand to Hyper-V guests? Ostensibly, not all VMWare guests have access to RdRand. It seems like the same might be true for Hyper-V. –  alx9r Mar 11 at 16:18
    
I don't have one handy. I watched a presentation given by an engineer on the Hyper-V development team talking about processors in guests. The point he was making is that any whitelisted instruction can be passed to a guest, and he used RdRand as being an example of a newly whitelisted instruction in 2012. –  longneck Mar 11 at 16:24
    
And that was a while ago when Server 2012 was new, so this is from memory. –  longneck Mar 11 at 16:30

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.