I'm creating a quantum random number generator as part of my thesis.
As part of the research phase, I'm trying to substantiate my aspertion that encryption is significantly weakened if a computer system has poor entropy available to it.
However, I can't seem to find any specific attacks that exploit this weakness.
Does anyone know of any specific attacks, theoretical or implemented, that I can read up on?
Netscape Navigator 1.1 1996
Ian Goldberg and David Wagner found out that Netscape Navigator 1.1 was using only three sources to seed their pseudo-random number generator (PRNG). The three sources were: the time of day, the process id, and the parent process id. They showed, these “random” sources aren’t that random and were relatively easy to figure out.
Debain 2008
DSA-1571-1 openssl -- predictable random number generator
Luciano Bello discovered that the random number generator in Debian's openssl package is predictable. This is caused by an incorrect Debian-specific change to the openssl package (CVE-2008-0166). As a result, cryptographic key material may be guessable.
And from Lessons from the Debian/OpenSSL Fiasco
they accidentally broke the OpenSSL pseudo-random number generator while trying to silence a Valgrind warning. One effect this had is that the ssh-keygen program installed on recent Debian systems (and Debian-derived systems like Ubuntu) could only generate 32,767 different possible SSH keys of a given type and size, so there are a lot of people walking around with the same keys.
XKCD for this is 424 and see Bruce Schneier's blog on this
RSA Weak Keys 2012
Mining Your Ps and Qs: Detection of Widespread Weak Keys in Network Devices
We performed a large-scale study of RSA and DSA cryptographic keys in use on the Internet and discovered that significant numbers of keys are insecure due to insufficient randomness. These keys are being used to secure TLS (HTTPS) and SSH connections for hundreds of thousands of hosts.
and a related question for this in Cryptography.SE
2016 Software vulnerabilities in the Brazilian voting machine
Aranha et. al Software vulnerabilities in the Brazilian voting machine - Usenix
2013 RSA: Citizen Digital Certificate of Taiwan
The random numbers generated by the batch of problematic cards obviously do not meet even minimal standards for collecting and processing entropy. This is a fatal flaw, and it can be expected to continue causing problems until all of the vulnerable cards are replaced.
The researchers investigate Taiwan’s national “Citizen Digital Certificate” database that contains more than two million RSA modulus. They have efficiently factored 184 distinct RSA keys. They are noticed that some of the primes occur more than was like p110 occurs 46-times. The reason was the flawed random-number generators in some of the smart cards.
This contains failed hardware and collecting and processing entropy.
Yubico 2019
Security advisory YSA-2019-02 – reduced initial randomness on FIPS keys
An issue exists in the YubiKey FIPS Series devices with firmware version 4.4.2 or 4.4.4 (there is no released firmware version 4.4.3) where random values leveraged in some YubiKey FIPS applications contain reduced randomness for the first operations performed after YubiKey FIPS power-up. The buffer holding random values contains some predictable content left over from the FIPS power-up self-tests which could affect cryptographic operations which require random data until the predictable content is exhausted.
In ECDSA signature this is catastrophic since the bias can be exploitable to signature forgeries. Even one-bit bias in the nonce can be exploitable.
More details in the links.
One notorious PRNG attack was the attack on the PRNG that was used for SSL in early versions of Netscape, as published in this paper written in 1996 by two PhD students at Berkeley. As explained in the paper, the PRNG relied on three sources of 'entropy': the time of day, the process ID, and the parent process ID.
There was an opensource ransomware named HiddenTear that created a random encryption key, but the key used Environment.TickCount as the seed, making it trivial to bruteforce the key.
It also created a version.txt file containing the encrypted computer name. So to break it you would use a ballpark estimate of how long the computer was running when the malware activated by reading the Created at attribute of an encrypted file, and creating random keys to decrypt version.txt. As soon as the value decrypted matched the computer name, you had the key.
Don't forget that entropy alone is not sufficient.
Most random number generators are pseudo random number generators. A source may produce high entropy number sequences but if the sequence is predictable enough it fails as a good random source. A classic example of this would be the digits of π (pi). The sequence has high entropy but is readily determined.
The k parameter in elliptic-curve cryptography is supposed to be a secret value that is never reused, and it's usually obtained from a random number generator. Two high-profile hacks that were possible due to not using secure random numbers for it:
