Re: [PROPOSAL/PATCH] Fortuna PRNG in /dev/random

[Jean-Luc Cooke <jlcooke@certainkey.com>]

On Fri, Sep 24, 2004 at 05:34:52PM -0400, Theodore Ts'o wrote:
> > Woh there.  Didn't you just say "see, these hashes are weakened.  That's
> > bad".  Now I just demonstrated the same thing with your SHA1 implementation
> > and you throw that "red-herring" phrase out again?
> 
> No, what I'm saying is that crypto primitives can get weakened; this
> is a fact of life.  SHA-0, MD4, MD5, etc. are now useless as general
> purpose cryptographic hashes.  Fortuna makes the assumptions that
> crypto primitives will never break, as it relies on them so heavily.
> I have a problem with this, since I remember ten years ago when people
> were as confident in MD5 as you appear to be in SHA-256 today.

http://eprint.iacr.org/2004/207.pdf

SHA-256 showing indications of weakness.  Fortuna's algorithms can be
replaced at compile-time.  I may even consider doing them at run-time.

> Crypto academics are fond of talking about how you can "prove" that
> Fortuna is secure.  But that proof handwaves around the fact that we
> have no capability of proving whether SHA-1, or SHA-256, is truly
> secure.

Our issues are that we are *both* handwaving.

JLC