2

Will two virtual machines running on the same physical host machine get the same value from /dev/random if read over the same time period?

Say that Virtual-machine-1 wants to generate its ssh host key. Virtual-machine-2 the random sniffer on the same physical host hosting the virtual machines saves /dev/random to a file on the disk. Is the random entropy the same between Virtual-machine-1 and Virtual-machine-2?

Would that make it easier to crack the crypto keys?

  • On some circumstances, if you duplicate one VM and then for example use the state of the then-duplicated RNG pool in both copies for generating a key for a stream cipher simultaneously, then they MIGHT get the exact same key, which WOULD reveal plaintext statistics for both those encrypted streams together. This is why the host always should inject entropy into the pool of every VM as they are created, before they need to perform any operations that need unique secrets. – Natanael Jun 25 '15 at 11:00
1

No, because /dev/random gathers environmental noise from device drivers. So unless you happen to have exactly the same events happening at the exact same time in both VMs, their random pool will differ enough to make this kind of attack impossible (or at least infeasible).

  • 3
    Given that in virtual machines tend to have isues gathering entropy, using /dev/random might be a bigger problem than first estimated since it gathers high entropy bits VERY slowly. See access.redhat.com/discussions/1203273 for slowness and 2uo.de/myths-about-urandom for /dev/random itself. An attack where a VM records ALL incoming random bits for a later crypto brute force is not impractical. – Jeff Meden Jun 23 '15 at 12:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.