1 | This document contains a description of portable OpenSSH's random |
---|
2 | number collection code. An alternate reading of this text could |
---|
3 | well be titled "Why I should pressure my system vendor to supply |
---|
4 | /dev/random in their OS". |
---|
5 | |
---|
6 | Why is this important? OpenSSH depends on good, unpredictable numbers |
---|
7 | for generating keys, performing digital signatures and forming |
---|
8 | cryptographic challenges. If the random numbers that it uses are |
---|
9 | predictable, then the strength of the whole system is compromised. |
---|
10 | |
---|
11 | A particularly pernicious problem arises with DSA keys (used by the |
---|
12 | ssh2 protocol). Performing a DSA signature (which is required for |
---|
13 | authentication), entails the use of a 160 bit random number. If an |
---|
14 | attacker can predict this number, then they can deduce your *private* |
---|
15 | key and impersonate you or your hosts. |
---|
16 | |
---|
17 | If you are using the builtin random number support (configure will |
---|
18 | tell you if this is the case), then read this document in its entirety. |
---|
19 | Alternately, you can use Lutz Jaenicke's PRNGd - a small daemon which |
---|
20 | collects random numbers and makes them available by a socket. |
---|
21 | |
---|
22 | Please also request that your OS vendor provides a kernel-based random |
---|
23 | number collector (/dev/random) in future versions of your operating |
---|
24 | systems by default. |
---|
25 | |
---|
26 | On to the description... |
---|
27 | |
---|
28 | The portable OpenSSH contains random number collection support for |
---|
29 | systems which lack a kernel entropy pool (/dev/random). |
---|
30 | |
---|
31 | This collector operates by executing the programs listed in |
---|
32 | ($etcdir)/ssh_prng_cmds, reading their output and adding it to the |
---|
33 | PRNG supplied by OpenSSL (which is hash-based). It also stirs in the |
---|
34 | output of several system calls and timings from the execution of the |
---|
35 | programs that it runs. |
---|
36 | |
---|
37 | The ssh_prng_cmds file also specifies a 'rate' for each program. This |
---|
38 | represents the number of bits of randomness per byte of output from |
---|
39 | the specified program. |
---|
40 | |
---|
41 | The random number code will also read and save a seed file to |
---|
42 | ~/.ssh/prng_seed. This contents of this file are added to the random |
---|
43 | number generator at startup. The goal here is to maintain as much |
---|
44 | randomness between sessions as possible. |
---|
45 | |
---|
46 | The entropy collection code has two main problems: |
---|
47 | |
---|
48 | 1. It is slow. |
---|
49 | |
---|
50 | Executing each program in the list can take a large amount of time, |
---|
51 | especially on slower machines. Additionally some program can take a |
---|
52 | disproportionate time to execute. |
---|
53 | |
---|
54 | This can be tuned by the administrator. To debug the entropy |
---|
55 | collection is great detail, turn on full debugging ("ssh -v -v -v" or |
---|
56 | "sshd -d -d -d"). This will list each program as it is executed, how |
---|
57 | long it took to execute, its exit status and whether and how much data |
---|
58 | it generated. You can the find the culprit programs which are causing |
---|
59 | the real slow-downs. |
---|
60 | |
---|
61 | The entropy collector will timeout programs which take too long |
---|
62 | to execute, the actual timeout used can be adjusted with the |
---|
63 | --with-entropy-timeout configure option. OpenSSH will not try to |
---|
64 | re-execute programs which have not been found, have had a non-zero |
---|
65 | exit status or have timed out more than a couple of times. |
---|
66 | |
---|
67 | 2. Estimating the real 'rate' of program outputs is non-trivial |
---|
68 | |
---|
69 | The shear volume of the task is problematic: there are currently |
---|
70 | around 50 commands in the ssh_prng_cmds list, portable OpenSSH |
---|
71 | supports at least 12 different OSs. That is already 600 sets of data |
---|
72 | to be analysed, without taking into account the numerous differences |
---|
73 | between versions of each OS. |
---|
74 | |
---|
75 | On top of this, the different commands can produce varying amounts of |
---|
76 | usable data depending on how busy the machine is, how long it has been |
---|
77 | up and various other factors. |
---|
78 | |
---|
79 | To make matters even more complex, some of the commands are reporting |
---|
80 | largely the same data as other commands (eg. the various "ps" calls). |
---|
81 | |
---|
82 | $Id: WARNING.RNG,v 1.1.1.1 2001-11-15 19:24:15 ghudson Exp $ |
---|
83 | |
---|