Re: /dev/urandom uses uninit bytes, leaks user data

[Phillip Susi <psusi@cfl.rr.com>]

Andrew Lutomirski wrote:
> No, it's there, and if there's little enough entropy around it can be
> recovered by brute force.

A little entropy is enough to prevent a brute force attack.  You would 
have to have ZERO entropy after a cold boot so the attacker would know 
exactly the contents of the pool, AND know that one and ONLY one other 
task has read from /dev/urandom, AND exactly what time that task did so, 
AND how many bytes it read.  Only then could the attacker read from 
urandom and based on those bytes and the previous known pool state, 
brute force the 3 bytes that came from some unknown location in the 
other task's memory.

>>> Step 1: Boot a system without a usable entropy source.
>>> Step 2: add some (predictable) "entropy" from userspace which isn't a
>>> multiple of 4, so up to three extra bytes get added.
>>> Step 3: Read a few bytes of /dev/random and send them over the network.
>> Only root can do 1 and 2, at which point, it's already game over.
> 
> Again, no.  Root could do this accidentally.  Step 1 happens all the
> time (see the comments on non-unique UUIDs).  Step 2 just requires a

It does not happen all the time.  It happens on a system that has just 
been cold booted from read only distribution media with a broken cmos 
clock, no user keyboard interaction, and no hardware rng and that's it. 
  Every other system is going to have some entropy from the last boot at 
least.