Re: Replace /dev/random input mix polynomial with Brent's xorgen?

["Theodore Ts'o" <tytso@mit.edu>]

On Sun, Dec 15, 2013 at 11:22:47PM -0500, George Spelvin wrote:
> 
> > Um, no.  The *ciphertext* is the output.  The attacker can get all of
> > the ciphertext he or she wants by reading /dev/random (although we'd
> > probably do some folding as we currently do so the attacker won't even
> > get all of the ciphertext).  What the attacker has to be able to do is
> > given some of the ciphertext bits, be able to predict future
> > ciphertext bits given some construction which uses AES as the basis.
> 
> The attack I was thinking of was figuring out (without breaking root and
> using ptrace) what some *other* process on the same machine is reading
> from /dev/random.
> 
> In other words, reading someone else's output.

I understand that; and as I wrote in my last e-mail, I think that is a
substantially harder attack than the currently published cache timing
attacks, which are known plaintext attacks --- that is the attacker
doesn't know the key, but can choose the plaintext, and view the
resulting ciphertext.

In this case, the attacker doen't know the key *and* the plaintext; it
can view its own attempt to read from /dev/random, but from that, it
needs to be able to figure out the the key and the plaintext (i.e.,
the entropy pool) in order to be able to predict someone else's output
of /dev/random.

If you think this is easier than the currently published cache timing
attacks, please provide details why you think this is the case,
preferably in the form of a demonstration....

						- Ted