Penetration Test Report (Cryptography Research): IntelRNG

T I ® R N G
HE NTEL ANDOM UMBER ENERATOR
CRYPTOGRAPHY RESEARCH, INC. WHITE PAPER PREPARED FOR INTEL CORPORATION
Benjamin Jun and Paul Kocher
April 22, 1999
Information in this white paper is provided without guarantee or warranty of any kind. This review represents the
opinions of Cryptography Research and may or may not reflect opinions of Intel Corporation. Characteristics of the
Intel RNG may vary with design or process changes. © 1999 by Cryptography Research, Inc. and Intel Corporation.
1. Introduction
∑n
H = −K p log p ,
i i
Good cryptography requires good random i=1
numbers. This paper evaluates the hardware-
where p is the probability of state i out of n
i
based Intel Random Number Generator (RNG)
possible states and K is an optional constant to
for use in cryptographic applications.
provide units (e.g., 1 bit). In the case of a
log(2)
Almost all cryptographic protocols require random number generator that produces a k-bit
the generation and use of secret values that must binary result, p is the probability that an output
i
be unknown to attackers. For example, random
will equal i, where
0≤i<2k.
Thus, for a
number generators are required to generate perfect random number generator, p = 2-k and
i
public/private keypairs for asymmetric (public
the entropy of the output is equal to k bits. This
key) algorithms including RSA, DSA, and
means that all possible outcomes are equally
Diffie-Hellman. Keys for symmetric and hybrid
(un)likely, and on average the information
cryptosystems are also generated randomly.
present in the output cannot be represented in a
RNGs are also used to create challenges, nonces
sequence shorter than k bits. In contrast, the
(salts), padding bytes, and blinding values. The
entropy of typical English alphabetic text is 1.5
one time pad – the only provably-secure bits per character.2
encryption system – uses as much key material
as ciphertext and requires that the keystream be An RNG for cryptographic applications
generated from a truly random process. should appear to computationally-bounded
adversaries to be close as possible to a perfect
Because security protocols rely on the
RNG. For this review, we analyze whether there
unpredictability of the keys they use, random
is any feasible way to distinguish the Intel RNG
number generators for cryptographic
from a perfect RNG.
applications must meet stringent requirements.
The most important is that attackers, including
2. Pseudorandomness
those who know the RNG design, must not be
able to make any useful predictions about the
Most “random” number sources actually
RNG outputs. In particular, the apparent entropy
utilize a pseudorandom generator (PRNG).
of the RNG output should be as close as
PRNGs use deterministic processes to generate
possible to the bit length.
a series of outputs from an initial seed state.
According to Shannon1, the entropy H of Because the output is purely a function of the
any message or state is: seed data, the actual entropy of the output can
never exceed the entropy of the seed. It can,
1 Shannon, C.E., “A Mathematical Theory of 2 Menezes, Oorschot, and Vanstone,
Communication,” The Bell System Technical Journal, Handbook of Applied Cryptography,
vol. 27, p. 379-423, July 1948. Ch.7, CRC Press, 1997.
ANALYSIS OF THE INTEL RANDOM NUMBER GENERATOR CRYPTOGRAPHY RESEARCH
however, be computationally infeasible to processes, but these methods are awkward and
distinguish a good PRNG from a perfect RNG. slow. For example, PGP4 version 6.02 requires
that users spend about 15 seconds entering
For example, a PRNG seeded with 256-bits
random keystrokes or mouse movements to
of entropy (or one with a 256-bit state) cannot
produce a new key. Methods involving user
produce more than 256 bits of true randomness.
timing require inelegant user interfaces and
An attacker who can guess the seed data can
cannot be used (or become insecure) when
predict the entire PRNG output. Guessing a 256-
controlled by automated scripts. Some
bit seed value is computationally infeasible,
applications use hard drive seek times, but
however, so it is possible that such a PRNG
factors such as the drive technology, disk
could be used in cryptographic applications.
caches, and system timer resolution limits
Examples of PRNGs designed for cryptographic
require careful consideration. Measurements of
applications include MD5Random and
system activity, delays, configuration data, etc.
SHA1Random (which respectively hold 128 bits
are also sometimes used.
and 160 bits of state) in the BSAFETM,3
cryptographic toolkit. Overall, true random number generators
implemented using conventional hardware tend
Although properly-implemented and seeded
to be slow, difficult to implement, require user
PRNGs are suitable for most cryptographic
involvement, and often provide unknown
applications, great care must be taken in the
amounts of true entropy. These methods also
development, testing, and selection of PRNG
make assumptions about the hardware that are
algorithms. It is critical that a PRNG be properly
not guaranteed. For example, operation timing
seeded from a reliable source. For example,
measurements may not contain the expected
most PRNGs included in standard software
amount of randomness under all system
libraries use predictable seed or state values or
configurations. Techniques that rely on user
produce output that can be distinguished from
events may not be reliable in unattended
random data.
systems such as
servers.
3. The Need for TRNGs Anyone who considers
Even though arithmetical methods of
it is possible for producing random digits
A true random number generator (TRNG)
uses a non-deterministic source to produce applications to is, of course, in a state of
randomness. Most operate by measuring produce their own sin.
secure random
unpredictable natural processes, such as thermal – John Von Neumann (1951)
data, many do not.
(resistance or shot) noise, atmospheric noise, or
Reviews by
nuclear decay. The entropy, trustworthiness, and
Cryptography Research frequently identify
performance all depend on the TRNG design.
weaknesses in random number generation.
A PRNG by itself will be insecure without a
Similarly, Christopher Allen and Tim Dierks of
TRNG for seeding. Seeding requires a source of
Consensus Development report that “most
true randomness, since it is impossible to create
common problems [found in software security
true randomness from within a deterministic
reviews] were related to random number
system. seeding.”5 Bruce Schneier writes, “Good
On computers without a hardware RNG, random-number generators are hard to design,
programmers typically try to obtain entropy for because their security often depends on the
seed data using existing peripherals. The most
common techniques involve timing user
4 PGP is available from Network Associates, Inc.
5 Dierks, T., and Allen, C., “Lessons from Doing
3 BSAFE is a software toolkit available from RSA Source Code Reviews of Commercial Products,”
Data Security, Inc. Consensus Development, 1997.
2
ANALYSIS OF THE INTEL RANDOM NUMBER GENERATOR CRYPTOGRAPHY RESEARCH
particulars of the hardware and
software. Many products we Voltage High-
Noise
examine use bad ones.”6 Controlled Speed
Amplifier
Oscillator Oscillator
Ian Goldberg and David
Wagner found that Netscape’s Johnson Thermal
random number generator seed Noise Source
was derived from “just three (Resistor) Super Latch
quantities: the time of day, the
process ID, and the parent process
ID. Thus, an adversary who can Control/
FIFO Digital Corrector
predict these three values can Status Reg.
apply the well-known MD5
algorithm to compute the exact
seed generated.”7 Although most Bus
RNG flaws are not reported,
Figure 1: Block diagram of the Intel RNG
problems are common, partly
because cryptographic software libraries often prove randomness, we have analyzed Intel’s
leave it to programmers to find reliable sources design assumptions, design, and testing
of seed material. procedures, as well as perfor