2

Reviewing openssl 1.0.1g s23_clnt.c code i see that :

int ssl23_connect(SSL *s)
    {
    BUF_MEM *buf=NULL;
    unsigned long Time=(unsigned long)time(NULL);
    void (*cb)(const SSL *ssl,int type,int val)=NULL;
    int ret= -1;
    int new_state,state;

    RAND_add(&Time,sizeof(Time),0);

This RAND_add(&Time,sizeof(Time),0) will not add entropy, but does it on the long run just create a predictable random ?

Reading https://www.openssl.org/docs/crypto/RAND_add.html there is a line "Thus, if the data at buf are unpredictable to an adversary, this increases the uncertainty about the state..." , what if buf is predictable... because time of initial connection is.

Since default random method is md_rand, i think buffer is added even if entropy is 0 and i think adding easily guessable information ( time is in seconds ) will dilute and on the long run make week random

Googling a little gave that https://www.schneier.com/blog/archives/2013/09/conspiracy_theo_1.html#c1694020 that just gives me same impression, but i really doubt such things would not have been kept for ages in openssl ( it was already there with a RAND_Seed(&Time, ... in SSLEAY of 1998 ) if it was so harmful.

So a basic question :

Does RAND_add(X,Y,0) with X guessable lower the random quality or keep it as it is ?

2

Mixing in easily guessable information never reduces entropy. In fact, that's the whole point of mixing: you can add information of dubious unpredictability, and all the unpredictability from uncorrelated sources adds up. So the mixture still has better entropy than before, or at worst just as much (if the new input is completely predictable).

To put it another way, the entropy of a RNG is the logarithm of the probability for an adversary to guess the sequence of random number (which for a PRNG is equivalent to guessing the (relevant portion of the) internal state). If the adversary can guess some of the input, that lets him establish a correlation between the state before adding that input and the state after. But that doesn't make the state after easier to guess than the state before.

All this assumes that the method for mixing entropy is a good one. This step is very easy to get wrong. As far as I know, ssleay_rand_add does it right.

Schneier's concern is not that there is a partially-predictable input, but that all the inputs are partially-predictable, to the point that the resulting generator state hasn't accumulated enough unpredictability. The problem isn't that unpredictability (entropy) goes down — it doesn't — but that it starts from 0 and may not have risen enough.

  • Yes i was assuming ssleay_rand_add was used, then it relies by default on underlying message digest SHA1, and then mixing applies to this algorithm. Thanks for this enlighted answer, it then infirm my fear and confirm it is rather a good thing to call RAND_Add() whatever the data to add is ( as long as initial state was itself seeded with enough entropy ). – philippe lhardy May 19 '14 at 7:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.