From owner-freebsd-stable@FreeBSD.ORG Wed Jan 15 18:53:48 2014 Return-Path: Delivered-To: freebsd-stable@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 6C95BDFA for ; Wed, 15 Jan 2014 18:53:48 +0000 (UTC) Received: from luigi.brtsvcs.net (luigi.brtsvcs.net [IPv6:2607:fc50:1000:1f00::2]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 4003419B2 for ; Wed, 15 Jan 2014 18:53:48 +0000 (UTC) Received: from chombo.houseloki.net (c-71-236-222-167.hsd1.wa.comcast.net [71.236.222.167]) by luigi.brtsvcs.net (Postfix) with ESMTPSA id 422842D4FAE; Wed, 15 Jan 2014 10:53:47 -0800 (PST) Received: from [IPv6:2601:7:880:bd0:24f3:10cb:6280:eceb] (unknown [IPv6:2601:7:880:bd0:24f3:10cb:6280:eceb]) by chombo.houseloki.net (Postfix) with ESMTPSA id C25C812F; Wed, 15 Jan 2014 10:53:45 -0800 (PST) Message-ID: <52D6D93F.7020600@bluerosetech.com> Date: Wed, 15 Jan 2014 10:53:51 -0800 From: Darren Pilgrim User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20100101 Thunderbird/24.2.0 MIME-Version: 1.0 To: Mike Tancsa , freebsd-stable@freebsd.org Subject: Re: [FreeBSD-Announce] FreeBSD Errata Notice FreeBSD-EN-14:01.random References: <201401142011.s0EKBoi7082738@freefall.freebsd.org> <52D6BF9C.8070405@bluerosetech.com> <52D6D5C7.80200@sentex.net> In-Reply-To: <52D6D5C7.80200@sentex.net> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-BeenThere: freebsd-stable@freebsd.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Production branch of FreeBSD source code List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 15 Jan 2014 18:53:48 -0000 On 1/15/2014 10:39 AM, Mike Tancsa wrote: > On 1/15/2014 12:04 PM, Darren Pilgrim wrote: >> >> 1. If you're on "bare metal", the attacker has firmware-level or >> physical access to the machine; >> 2. If you're on a hypervisor, you can't trust the hypervisor; >> >> In both cases, I would think the attacker can use much simpler, more >> direct vectors and you have much worse things to worry about than the >> quality of /dev/random. I'm not questioning the validity of the >> advisory, I'm genuinely curious about this. I can't think of a scenario >> were someone could attack /dev/random using this vector without 1 or 2 >> above also being true. > > Say you have a physical tap on the network upstream from the victim. The > victim is exchanging data across a VPN. You can capture the encrypted > traffic, and knowing there is a weakness in the quality of RNG, more > easily decode the encrypted traffic. You dont have to worry about > sending "extra" traffic from the host say, by poking around in /dev/mem > etc. Yes, that's an obvious consequence of a compromised RNG; but that's not what I was asking. I'm asking how the attacker could compromise the hardware RNG without also obtaining effectively unfettered access to the entire system.