Hacker News Reader

Comment by thrownaway2424 | Hacker News Reader

From a full-system threat analysis standpoint this seems like a truly bad idea. You think you have some kind of fancy rng but actually what you have is an rng that your adversary can sneak in and swap out with an infinite generator of zeroes while you're in the bathroom of the airplane. Essentially you've made yourself way more vulnerable to rng attacks than you would have been with a regular entropy source. If you bought one of these you'd have to be totally committed to keeping it on your person at all times.

View on HN

If you have an adversary with physical access, are not all bets off?

It seems like an adversary who could swap your rng could install a radio broadcaster between your keyboard and your pc or reboot to a rootkit.

Oppositely, you might paint your rng with sparkles or other unique paint schemes to mitigate that particular switch risk but then you'd still have the other possibilities.

Anyway, I don't think this kind of physical spy versus spy stuff is the main risk a custom rng is intended for.

If you XOR'd this RNG's output with, say, /dev/urandom, you could mitigate that risk significantly (you would be no worse off than before).

The way for USB key RNGs to combat that is to encrypt the random number stream. That's what Simtec's Entropy Key[1] did. Your adversary would not know the secret that is shared between the USB device and the computer, and so the swap would be immediately detected.

That said, if you have an adversary that has and is devoting the time and resources necessary to arrange to have someone on the plane with you, with a doctored USB RNG, in a seat where they can get to your laptop when you go to the bathroom and mess with it, you probably should not be traveling alone, and your traveling laptop should be one that never contains important secrets and is never connected to a network that has important secrets.

[1] http://www.entropykey.co.uk

Maybe the driver can verify that the real thing is there.

Indeed, they say that it looks for a deviation from expected random noise.

...So someone replaces it with known random stream. Or, say, a known PRNG.

The malicious device could simply respond with a bunch of random bits which were recorded earlier.

This isn't my field, but I'm not sure if they should check for 3% or 0.3%.

Reply on news.ycombinator.com