From owner-freebsd-security@FreeBSD.ORG Fri Jul 18 00:02:40 2014 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 2E176D41 for ; Fri, 18 Jul 2014 00:02:40 +0000 (UTC) Received: from manchester-1.man.uk.cluster.ok24.net (manchester-1.man.uk.cluster.ok24.net [213.138.100.64]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id BAF972042 for ; Fri, 18 Jul 2014 00:02:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=simple/simple; d=pyro.eu.org; s=07.2014; h=Content-Transfer-Encoding:Content-Type:Subject:To:MIME-Version:From:Date:Message-ID; bh=QYo2mw8XWBHDIuq2G7f/D/4fR4VWY9rZULLB2Syufbo=; b=IWDITGroc6Ma6zWsBYGzfbPcMJAyuiT3CPuvJ3SYJx8L6YZXeP+rGO+aGAczrMVQCkBhQ2ALi2Ssjt9X0I+31kn37GMeCC+k95/B3zcwu3cl+9CF8m1vsTpFPNOrbDZLpan83jzl9HfA7ES7nBj8np91yJDbohxa3yTnaePHy9E=; X-Spam-Status: No, score=-1.1 required=2.0 tests=ALL_TRUSTED, BAYES_00, DKIM_ADSP_DISCARD Received: from guisborough-1.rcc.uk.cluster.ok24.net ([217.155.40.118]) by manchester-1.man.uk.cluster.ok24.net with esmtps (TLSv1:AES256-SHA:256) (Exim 4.80) (envelope-from ) id 1X7vJD-0006ez-RX for freebsd-security@freebsd.org; Fri, 18 Jul 2014 00:41:57 +0100 Received: from [10.0.1.191] by guisborough-1.rcc.uk.cluster.ok24.net with esmtpsa (TLS1.0:DHE_RSA_AES_128_CBC_SHA1:16) (Exim 4.69) (envelope-from ) id 1X7vJD-00013o-Bx for freebsd-security@freebsd.org; Fri, 18 Jul 2014 00:41:55 +0100 Message-ID: <53C85F42.1000704@pyro.eu.org> Date: Fri, 18 Jul 2014 00:41:54 +0100 From: Steven Chamberlain User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Icedove/24.6.0 MIME-Version: 1.0 To: freebsd-security@freebsd.org Subject: Speed and security of /dev/urandom X-Enigmail-Version: 1.6 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 18 Jul 2014 00:02:40 -0000 Hi, FreeBSD is as far as I know, quite unique in using Yarrow to provide a nice, fast CSPRNG for /dev/urandom But OpenSSL, LibreSSL, OpenSSH, and various reimplementations of arc4random(), don't directly use it. They typically take only ~128 bits from /dev/urandom or through other means, to seed a stream cipher, then return the output of that. I understand why Linux, even OpenBSD must do that. Good-quality random bits from the kernel are scarce, so they *must* be stretched somehow. But isn't that essentially what Yarrow does already in FreeBSD? Is there a good reason arc4random_buf() can't take bytes directly from /dev/urandom or sysctl KERN_ARND? Therefore no longer needing to seed first, periodically reseed, or use any stream cipher? There are a few reasons I mention it now: * arc4random relies on the stream cipher being cryptographically strong between reseeds, or else you could guess previous/later output. FreeBSD still uses RC4 for arc4random, and that seems increasingly risky; OpenBSD moved recently to ChaCha-20, but who knows if even that will prove to be safe in the longer term? * after seeding, some arc4random implementations completely forget to reseed after the process forks - the same 'random' stream of bytes could occur twice, with security implications * LibreSSL tried to detect forking, and to reseed automatically, but Andrew Ayer showed a corner-case where that still didn't work as expected (CVE-2014-2970) * some arc4random implementations might not be thread-safe * (re)seeding can fail sometimes (fd's exhausted reading /dev/urandom, or that is missing in a chroot; even a sysctl might return an error code); OpenSSL and LibreSSL each have 'scary' ways to try to gather entropy in userland as a fallback, especially for Linux; FreeBSD and OpenBSD may have better expectations that the sysctl will work, and maybe raise SIGKILL otherwise So I wonder, could a simplified arc4random for FreeBSD use Yarrow directly, to avoid making any of these sorts of mistakes we've seen? (There's also the benefit that having many readers from a single pseudorandom stream, adds an additional kind of randomness to its output). This is obviously a complex issue, and some of it will be subjective. But I welcome your comments. Thanks! Regards, -- Steven Chamberlain steven@pyro.eu.org