Mercurial > dropbear

annotate notes/tech0004.txt @ 390:d8e44bef7917 libtomcrypt-dropbear

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Replace // with /* */
author Matt Johnston <matt@ucc.asn.au>
date Thu, 11 Jan 2007 04:28:09 +0000
parents 59400faa4b44
children
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
280
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
1 Tech Note 0004
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
2 Using Yarrow, Fortuna and SOBER-128
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
3 Tom St Denis
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
4
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
5 Introduction
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
6 ------------
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
7
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
8 This tech note explains how to use three of the more useful pseudo random number generators and their
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
9 own little "issues". While all of the PRNGs have the same API and are roughly used in the same
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
10 manner their effectiveness really depends on the user knowing how they work.
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
11
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
12
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
13 Yarrow
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
14 ------
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
15
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
16 Yarrow is by far the simplest of the PRNGs. It gathers bits of entropy by hashing the pool state
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
17 plus the additional bits storing the message digest back in the pool. E.g.
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
18
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
19 pool = hash(pool || newbits)
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
20
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
21 Simply dump bits into the PRNG via yarrow_add_entropy() and call yarrow_ready() when you want to
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
22 put them to use. This PRNG while simple is not entirely safe. An attacker who learns the state
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
23 of the pool and can control future events can control the PRNG. This requires an active attacker but
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
24 isn't entire impossible.
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
25
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
26 The pool is then used as a key for a cipher that is used in CTR mode.
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
27
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
28 Yarrow is mostly meant for short-term programs [e.g. like file utils]. This particular implementation
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
29 is not meant for long-term usage.
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
30
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
31 Fortuna
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
32 -------
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
33
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
34 Fortuna was designed by Niels Fergusson and Bruce Schneier [Bruce is also the guy who invented Yarrow]. It
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
35 operates on a more defensive level than Yarrow. Instead of 1 entropy pool it has 32 and the new entropy
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
36 is spread [round robin] in all of the pools.
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
37
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
38 That is, each call to fortuna_add_entropy() puts the bits in the next [in the sequenece] pool of entropy.
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
39 Effective bits are added to the pool by sending them through a hash [but not terminating the hash].
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
40
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
41 Here's the main catch though. When the PRNG must be reseeded [so that you can extract bits from it] only
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
42 certain pools are used. More precisely the i'th pool is used every 2**i'th reseeding. For example, pool[0]
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
43 is always used. pool[1] is used every second reseeding, pool[2] every fourth.
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
44
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
45 The pools are hashed together along with the current key and the result is the new key for a cipher which
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
46 operates in CTR mode [more about that in a sec].
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
47
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
48 Now this may seem odd at first however there is a good reason behind it. An attacker who learns pool[0] won't
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
49 strictly know the other pools. So the recovery rate of is not 0. In fact pool[0] can be completely
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
50 compromised and the PRNG will still eventually recover. The value FORTUNA_WD is the "WatchDog" counter.
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
51 Every FORTUNA_WD calls to fortuna_read will invoke the reseed operation. By default this is set to 10 which
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
52 means after 10 calls the PRNG will reseed itself.
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
53
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
54 The pools are combined with the running cipher key [256 bits] so that a cipher in CTR mode can produce
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
55 the stream. Unlike Yarrow the cipher is re-keyed after every call to fortuna_read() [so one big call
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
56 would be faster than many smaller calls]. This prevents too much data being encrypted under the same
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
57 key [and mitigates a flaw in CTR mode that the same block can't be emitted twice under the same key].
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
58
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
59 Fortuna is really meant for a kernel-level PRNG. The more sources [and often] you feed into it the
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
60 healthier it will be. It's also meant to be used for long term purposes. Since it can recover from
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
61 compromises it is harder to control it.
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
62
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
63 SOBER-128
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
64 ------
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
65
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
66 SOBER-128 is actually a stream cipher but like most ciphers can easily be modelled in the context of a PRNG.
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
67 This PRNG is extremely fast [4 cycles/byte on a P4] and was designed by a well known cryptographer [Greg Rose].
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
68
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
69 SOBER-128 doesn't really "act" like the other two PRNGs. It's meant to be seeded once and then read as
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
70 required. In such a sense it isn't a "system PRNG" but useful short term purposes. In particular
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
71 the sober128_read() function actually XORs against the input buffer you specify. This allows the
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
72 read() function to be used as an "encrypt" function as well.
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
73
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
74 You can only key SOBER-128 once [by calling sober128_add_entropy()]. Once it it is keyed subsequent
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
75 calls to add_entropy() will be considered a "re-IV" operation. Changing the IV allows you to use same
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
76 initial key and not produce the same output stream. It also lets you differentiate packets. E.g. each
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
77 packet has it's own IV.
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
78
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
79 All inputs to sober128_add_entropy() must have a length that is a multiple of four.
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
80
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
81 Overall
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
82 -------
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
83
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
84 Since SOBER-128 is *much* faster than the other two PRNGs a good setup would be to use Fortuna as your
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
85 system-wide PRNG and use SOBER-128 [key'ed from Fortuna] for encrypting streams or as a PRNG for
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
86 simulations.
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
87
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
88 Yarrow is still a good candidate but only for "short lived" programs. However, since Fortuna is faster
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
89 [by about 10 cycles/byte on a P4] I'd use Fortuna anyways...
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
90
59400faa4b44 Re-import libtomcrypt 1.05 for cleaner propagating.
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
91 Tom