[147878] in cryptography@c2.net mail archive
[Cryptography] My comments regarding using CPU jitter for random
daemon@ATHENA.MIT.EDU (tytso@mit.edu)
Tue Oct 29 12:26:42 2013
X-Original-To: cryptography@metzdowd.com
Date: Mon, 28 Oct 2013 23:03:43 +0000
From: tytso@mit.edu
To: cryptography@metzdowd.com
X-SA-Exim-Mail-From: tytso@thunk.org
Errors-To: cryptography-bounces+crypto.discuss=bloom-picayune.mit.edu@metzdowd.com
VGhlcmUgaXMgYSB0aHJlYWQgb24gTEtNTCB3aGljaCBJIGNvbW1lbmQgdG8gcGVvcGxlIHBlb3Bs
ZSBpbnRlcmVzdGVkCmluIHRoaXMgc3ViamVjdC4gIFRoZSB0aHJlYWQgc3RhcnRzIGhlcmU6Cgpo
dHRwczovL2xrbWwub3JnL2xrbWwvMjAxMy8xMC8xMS81ODIKCi4uLiBhbmQgbXkgY29tbWVudHMg
Y2FuIGJlIGZvdW5kIGhlcmU6CgpodHRwczovL2xrbWwub3JnL2xrbWwvMjAxMy8xMC8yOC81OTgK
CkknbSBnb2luZyB0byB0YWtlIHRoZSBsaWJlcnR5IG9mIHJlcHJvZHVjaW5nIG15IGNvbW1lbnRz
IGhlcmUsIGJlY2F1c2UKSSB0aGluayBpdCdzIGVzcGVjaWFsbHkgcmVsZXZhbnQgdG8gc29tZSBv
ZiB0aGUgZGlzY3Vzc2lvbnMgd2UndmUgYmVlbgpoYXZpbmcgb24gdGhlIENyeXB0b2dyYXBoeSBs
aXN0IHZpcy1hLXZpcyByYW5kb20gbnVtYmVyIGdlbnJlYXRpb24uCgoJCQkJCQktIFRlZAoKU3Vi
amVjdDogUmU6IFtQQVRDSF0gQ1BVIEppdHRlciBSTkc6IGluY2x1c2lvbiBpbnRvIGtlcm5lbCBj
cnlwdG8gQVBJIGFuZAogICAgICAgIC9kZXYvcmFuZG9tCgpGdW5kYW1lbnRhbGx5LCB3aGF0IHdv
cnJpZXMgbWUgYWJvdXQgdGhpcyBzY2hlbWUgKGFjdHVhbGx5LCBjYXVzZXMgdGhlCmhhaXIgb24g
dGhlIGJhY2sgb2YgbXkgbmVjayB0byByaXNlIHVwIG9uIGVuZCkgaXMgdGhpcyBzdGF0ZW1lbnQg
aW4KeW91ciBkb2N1bWVudGF0aW9uWzFdOgoKICAgV2hlbiBsb29raW5nIGF0IHRoZSBzZXF1ZW5j
ZSBvZiB0aW1lIGRlbHRhcyBnYXRoZXJlZAogICBkdXJpbmcgdGVzdGluZ+KAiltEXeKAiiwgbm8g
cGF0dGVybiBjYW4gYmUgZGV0ZWN0ZWQuIFRoZXJlZm9yZSwgdGhlCiAgIGZsdWN0dWF0aW9uIGFu
ZCB0aGUgcmVzdWx0aW5nIGRpc3RyaWJ1dGlvbiBhcmUgbm90IGJhc2VkIG9uIGEKICAgcmVwZWF0
aW5nIHBhdHRlcm4gYW5kIG11c3QgYmUgY29uc2lkZXJlZCByYW5kb20uCgpbMV0gaHR0cDovL3d3
dy5jaHJvbm94LmRlL2plbnQvZG9jL0NQVS1KaXR0ZXItTlBUUk5HLmh0bWwKCkp1c3QgYmVjYXVz
ZSB3ZSBjYW4ndCBkZXRlY3QgYSBwYXR0ZXJuIGRvZXMgKipub3QqKiBtZWFuIHRoYXQgaXQgaXMK
bm90IGJhc2VkIG9uIGEgcmVwZWF0aW5nIHBhdHRlcm4sIGFuZCB0aGVyZWZvcmUgbXVzdCBiZSBj
b25zaWRlcmVkCnJhbmRvbS4gIFdlIGNhbid0IGRldGVjdCBhIHBhdHRlcm4gaW4gUkRSQU5ELCBz
byBkb2VzIHRoYXQgbWVhbiBpdCdzCmF1dG9tYXRpY2FsbHkgcmFuZG9tPyAgV2h5LCBuby4KCklm
IGFsbCB5b3UgaGF2ZSBpcyB0aGUgb3V0cHV0IG9mICJBRVNfRU5DUlBZVChOU0FfS0VZLCBpKysp
Ii4gYW5kCk5TQV9LRVkgaXMgbm90IGtub3duIHRvIHlvdSwgeW91IHdvbid0IGJlIGFibGUgdG8g
ZGV0ZWN0IGEgcGF0dGVybiwKZWl0aGVyLiAgQnV0IEkgY2FuIGd1YXJhbnRlZSB0byB5b3UgdGhh
dCBpdCdzIG5vdCByYW5kb20uLi4KCkl0IG1heSBiZSB0aGF0IHRoZXJlIGlzIHNvbWUgdmVyeSBj
b21wbGV4IHN0YXRlIHdoaWNoIGlzIGhpZGRlbiBpbnNpZGUKdGhlIHRoZSBDUFUgZXhlY3V0aW9u
IHBpcGVsaW5lLCB0aGUgTDEgY2FjaGUsIGV0Yy4sIGV0Yy4gIEJ1dCBqdXN0CmJlY2F1c2UgKnlv
dSogY2FuJ3QgZmlndXJlIGl0IG91dCwgYW5kIGp1c3QgYmVjYXVzZSAqSSogY2FuJ3QgZmlndXJl
Cml0IG91dCBkb2Vzbid0IG1lYW4gdGhhdCBpdCBpcyBpcHNvIGZhY3RvIHNvbWV0aGluZyB3aGlj
aCBhIHJlYWxseQpicmlnaHQgTlNBIGFuYWx5c3Qgd29ya2luZyBpbiBGb3J0IE1lYWRlIGNhbid0
IGZpZ3VyZSBvdXQuICAoT3IgaGVjaywKYSByZWFsbHkgY2xldmVyIEludGVsIGVuZ2luZWVyIHdo
byBoYXMgZnVsbCB2aXNpYmlsaXR5IGludG8gdGhlCmludGVybmFsIGRlc2lnbiBvZiBhbiBJbnRl
bCBDUFUuLi4uKQoKTm93LCBpdCBtYXkgYmUgdGhhdCBpbiBwcmFjdGljZSwgYW4gYWR2ZXJzYXJ5
IHdvbid0IGJlIGFibGUgdG8gY2FycnkKb3V0IGEgcHJhY3RpY2FsIGF0dGFjayBiZWNhdXNlIHRo
ZXJlIHdpbGwgYmUgZXh0ZXJuYWwgaW50ZXJydXB0cyB0aGF0CnRoZSBhZHZlcnNhcnkgd29uJ3Qg
YmUgYWJsZSB0byBwdXQgaW50byBoaXMgb3IgaGVyIG1vZGVsIG9mIHlvdXIgQ1BVCi0tLSBmb3Ig
ZXhhbXBsZSwgZnJvbSBuZXR3b3JrIGludGVycnVwdHMgb3Iga2V5Ym9hcmQgaW50ZXJydXB0cy4g
IEJ1dAppbiB0aGF0IGNhc2UsIGl0J3MgdG8gbWVhc3VyZSBqdXN0IHRoZSBpbnRlcnJ1cHQsIGJl
Y2F1c2UgaXQgbWF5IGJlCnRoYXQgdGhlIDMyIGludGVycnVwdHMgdGhhdCB5b3UgZ290IHdoaWxl
IGV4dHJhY3RpbmcgMTI4IGJpdHMgb2YKZW50cm9weSBmcm9tIHlvdXIgaml0dGVyIGVuZ2luZSB3
YXMgb25seSAzMiBiaXRzIG9mIGVudHJvcHksIGFuZCB0aGUKcmVzdCBjb3VsZCBiZSBkZXRlcm1p
bmVkIGJ5IHNvbWVvbmUgd2l0aCBzdWZmaWNpZW50IGtub3dsZWRnZSBhbmQKdW5kZXJzdGFuZGlu
ZyBvZiB0aGUgaW50ZXJuYWwgZ3V0cyBvZiB0aGUgQ1BVLiAgKFRyZWF0aW5nIHRoaXMKb2JzY3Vy
aXR5IGFzIHNlY3VyaXR5IGlzIHByb2JhYmx5IG5vdCBhIGdvb2QgaWRlYTsgd2UgaGF2ZSB0byBh
c3N1bWUKdGhlIE5TQSBjYW4gZ2V0IGl0cyBoYW5kcyBvbiBhbnl0aGluZyBpdCB3YW50cywgZXZl
biBpbnRlcm5hbCwKc3VwZXItc2VjcmV0LCAiYmxhY2sgY292ZXIiIEludGVsIGRvY3VtZW50cy4g
IDotKQoKVG8gYmUgaG9uZXN0LCBJIGhhdmUgZXhhY3RseSB0aGUgc2FtZSB3b3JyeSBhYm91dCBy
ZWx5aW5nIG9uIEhERAppbnRlcnJ1cHRzLiAgVGhlIHRoZW9yZXRpY2FsIGJhc2lzIG9mIHRoaXMg
cmVzdWx0aW5nIGluIHRydWUKcmFuZG9tbmVzcyBpcyBiYXNlZCBvbiBhIDE5OTQgcGFwZXIgYnkg
RG9uIERhdmlzOiAiQ3J5cHRvZ3JhcGhpYwpyYW5kb21uZXNzIGZyb20gYWlyIHR1cmJ1bGVuY2Ug
aW4gZGlzayBkcml2ZXMiWzJdOgoKWzJdIGh0dHA6Ly93b3JsZC5zdGQuY29tL35kdGQvcmFuZG9t
L2ZvcndhcmQucGRmCgpUaGUgcHJvYmxlbSBpcyB0aGF0IGFsbW9zdCB0d28gZGVjYWRlcyBsYXRl
ciwgdGhlIHRlY2hub2xvZ3kgb2YgSEREJ3MsCmFuZCBjZXJ0YWlubHkgU1NEICh3aGljaCBkaWRu
J3QgZXhpc3QgYmFjayB0aGVuKSBoYXZlIGNoYW5nZWQgcXVpdGUgYQpsb3QuICBJdCBpcyBub3Qg
b2J2aW91cyB0byBtZSBob3cgbXVjaCBlbnRyb3B5IHlvdSBjYW4gcmVhbGx5IGdldCBmcm9tCm9i
c2VydmluZyB0aGUgZGlzayBjb21wbGV0aW9uIHRpbWVzIGlmIHlvdSBhc3N1bWUgdGhhdCB0aGUg
YWR2ZXJzYXJ5CmhhcyBjb21wbGV0ZSBrbm93bGVkZ2UgdG8gdGhlIHJlbGF0aXZlIHRpbWluZyBh
bmQgYmxvY2sgbnVtYmVycyBvZiB0aGUKZGlzayBhY2Nlc3NlcyBmcm9tIHRoZSBPUyAoZm9yIGV4
YW1wbGUsIGlmIHdlIGJvb3QgbXVsdGlwbGUgbW9iaWxlCnBob25lIGZyb20gZmxhc2ggZm9yIHRo
ZSBmaXJzdCB0aW1lLCBob3cgbWFueSBiaXRzIG9mIGVudHJvcHkgYXJlCnRoZXJlIHJlYWxseT8p
CgpCdXQgYXQgbGVhc3QgYmFjayBpbiAxOTk0LCB0aGVyZSB3YXMgYW4gYXR0ZW1wdCB0byBjb21l
IHVwIHdpdGggYQpwaHlzaWNhbCB0aGVvcnkgYXMgdG8gd2hlcmUgdGhlIGVudHJvcHkgd2FzIGNv
bWluZyBmcm9tLCBhbmQgdGhlbiBhcwptdWNoIHdvcmsgYXMgcG9zc2libGUgdG8gcnVsZSBvdXQg
b3RoZXIgcG9zc2libGUgY2F1c2VzIG9mIHRoZQp1bmNlcnRhaW50eS4KClNvIGlmIHlvdSB3YW50
IHRvIHJlYWxseSBjb252aW5jZSB0aGUgd29ybGQgdGhhdCBDUFUgaml0dGVyIGlzIHJhbmRvbSwK
aXQncyBub3QgZW5vdWdoIHRvIGNsYWltIHRoYXQgaXQgeW91IGNhbid0IHNlZSBhIHBhdHRlcm4u
ICBXaGF0IHlvdQpuZWVkIHRvIGRvIGlzIHRvIHJlbW92ZSBhbGwgcG9zc2libGUgc291cmNlcyBv
ZiB0aGUgdW5jZXJ0YWludHksIGFuZApzaG93IHRoYXQgdGhlcmUgaXMgc3RpbGwgbm8gZGlzY2Vy
bmFibGUgcGF0dGVybiBhZnRlciB5b3UgZG8gdGhpbmdzCmxpa2UgKGEpIHJ1biBpbiBrZXJuZWwg
c3BhY2UsIG9uIGFuIG90aGVyd2lzZSBxdWlzY2VudCBjb21wdXRlciwgKGIpCmRpc2FibGUgaW50
ZXJydXB0cywgc28gdGhhdCBhbnkgdW5jZXJ0YWludHkgY2FuJ3QgYmUgY29taW5nIGZyb20KaW50
ZXJydXB0cywgZXRjLiwgVHJ5IHRvIHJ1bGUgaXQgYWxsIG91dCwgYW5kIHRoZW4gc2VlIGlmIHlv
dSBzdGlsbApnZXQgdW5jZXJ0YWludHkuCgpJZiB5b3UgdGhpbmsgaXQgaXMgZnJvbSBEUkFNIHRp
bWluZywgZmlyc3QgdHJ5IGFjY2Vzc2luZyB0aGUgc2FtZQptZW1vcnkgbG9jYXRpb24gaW4ga2Vy
bmVsIGNvZGUgd2l0aCB0aGUgaW50ZXJydXB0cyBvZmYsIG92ZXIgYW5kIG92ZXIKYWdhaW4sIHNv
IHRoYXQgdGhlIG1lbW9yeSBpcyBwaW5uZWQgaW50byBMMSBjYWNoZS4gIFlvdSBzaG91bGQgYmUg
YWJsZQp0byBnZXQgY29uc2lzdGVudCByZXN1bHRzLiAgSWYgeW91IGNhbiwgdGhlbiBpZiB5b3Ug
dGhlbiB0cnkgdG8gcmVhZApmcm9tIERSQU0gd2l0aCB0aGUgTDEgYW5kIEwyIGNhY2hlcyBkaXNh
YmxlZCwgYW5kIHdpdGggaW50ZXJydXB0cwp0dXJuZWQgb2ZmLCBldGMsIGFuZCBzZWUgaWYgeW91
IGdldCBjb25zaXN0ZW50IHJlc3VsdHMgb3IgaW5jb25zaXN0ZW50CnJlc3VsdHMuICBJZiB5b3Ug
Z2V0IGNvbnNpc3RlbnQgcmVzdWx0cyBpbiBib3RoIGNhc2VzLCB0aGVuIHlvdXIKaHlwb3RoZXNp
cyBpcyBkaXNwcm92ZW4uICBJZiB5b3UgZ2V0IGNvbnNpc3RlbnQgcmVzdWx0cyB3aXRoIHRoZQpt
ZW1vcnkgcGlubmVkIGluIEwxIGNhY2hlLCBhbmQgaW5jb25zaXN0ZW50IHJlc3VsdHMgd2hlbiB0
aGUgTDEgYW5kIEwyCmNhY2hlIGFyZSBkaXNhYmxlZCwgdGhlbiBtYXliZSB0aGUgdGltaW5nIG9m
IERSQU0gcmVhZHMgcmVhbGx5IGFyZQppbnRyb2R1Y2luZyBlbnRyb3B5LiAgQnV0IHRoZSBwb2lu
dCBpcyB5b3UgbmVlZCB0byB0ZXN0IGVhY2ggcGFydCBvZgp0aGUgc3lzdGVtIGluIGlzb2xhdGlv
biwgc28geW91IGNhbiBwb2ludCBhdCBhIHNwZWNpZmljIHBhcnQgb2YgdGhlCnN5c3RlbSBhbmQg
c2F5LCAqdGhhdConcyB3aGVyZSBhdCBsZWFzdCBzb21lIHVuY2VydGFpbnR5IHdoaWNoIGFuCmFk
dmVyc2FyeSBjYW4gbm90IHJldmVyc2UgZW5naW5lZXIsIGFuZCBoZXJlIGlzIHRoZSBwaHlzaWNh
bCBwcm9jZXNzCmZyb20gd2hpY2ggdGhlIGNob2F0aWMgYWlyIHBhdHRlcm5zLCBvciBxdWFudHVt
IGVmZmVjdHMsIGV0Yy4sIHdoaWNoCmlzIGh5cG90aGVzaXplZCB0byBjYXVzZSB0aGUgdW5jZXJ0
YWludHkuCgpBbmQgbm90ZSB0aGF0IHdoZW4geW91IGRvIHRoaXMsIHlvdSBjYW4ndCB1c2UgYW55
IHVuYmlhc2luZyBvcgp3aGl0ZW5pbmcgdGVjaG5pcXVlcyAtLS0geW91IHdhbnQgdG8gdXNlIHRo
ZSByYXcgdGltaW5ncywgYW5kIHRoZW4gZG8KdGhpbmdzIGxpa2UgbG9vayB2ZXJ5IGhhcmQgZm9y
IGFueSBraW5kIG9mIHBhdHRlcm5zOyBEb24gRGF2aXMgdXNlZApGRlQncyBiZWNhdXNlIGhlIHdh
bnRlZCB0byBsb29rIGZvciBhbnkgcGF0dGVybnMgdGhhdCBtaWdodCBiZQppbnRyb2R1Y2VkIGJ5
IHRoZSByb3RhdGluZyBwbGF0dGVybiwgd2hpY2ggd291bGQgcHJlc3VtYWJseSB3b3VsZCBzaG93
CnVwIGluIGEgZnJlcXVlbmN5IGRvbWFpbiBhbmFseXNpcyBldmVuIGlmIGl0IHdhcyBpbnZpc2li
bGUgaW4gdGhlIHRpbWUKZG9tYWluLgoKSWYgeW91IGRvbid0IGRvIGFsbCBvZiB0aGlzIHdvcmss
IHRoZXJlIGlzIG5vIHdheSB0byBrbm93IGZvciBzdXJlCndoZXJlIHRoZSBlbnRyb3B5IGlzIGNv
bWluZyBmcm9tLiAgQW5kIGlmIHlvdSBkb24ndCBrbm93LCB0aGF0J3Mgd2hlbgp5b3UgaGF2ZSB0
byBiZSB2ZXJ5LCB2ZXJ5IGNvbnNlcnZhdGl2ZSwgYW5kIHVzZSBhIHZlcnkgbGFyZ2UKZW5naW5l
ZXJpbmcgc2FmZXR5IG1hcmdpbi4gIEN1cnJlbnRseSB3ZSB1c2UgdGhlIGhpZ2ggcmVzb2x1dGlv
biBDUFUKY291bnRlciwgcGx1cyB0aGUgaW50ZXJydXB0ZWQgSVAsIGFuZCB3ZSBtaXggYWxsIG9m
IHRoaXMgdG9nZXRoZXIgZnJvbQo2NCBpbnRlcnJ1cHRzLCBhbmQgd2UgY291bnQgdGhpcyBhcyBh
IHNpbmdsZSBiaXQgb2YgZW50cm9weS4gIEkgKmhvcGUqCnRoYXQgYXQgbGVhc3Qgb25lIG9mIHRo
b3NlIGludGVycnVwdHMgaGFzIHN1ZmZpY2llbnQgdW5wcmVkaWN0YWJseSwKcGVyaGFwcyBiZWNh
dXNlIHRoZSByZW1vdGUgYXR0YWNrZXIgY2FuJ3Qga25vdyB3aGVuIGEgTEFOIGludGVycnVwdApo
YXMgaGFwcGVuZWQsIHN1Y2ggdGhhdCBoYXZlIGEgc2luZ2xlIGJpdCBvZiBlbnRyb3B5LgoKTWF5
YmUgc29tZW9uZSBjYW4gcHJvdmUgdGhhdCB0aGVyZSBpcyBtb3JlIGVudHJvcHkgYmVjYXVzZSBv
ZiBzb21lCmluc3RhYmlsaXR5IGJldHdlZW4gdGhlIG9zY2lsbGF0b3IgdXNlZCBieSB0aGUgQ1BV
IGNsb2NrIGFuZCB0aGUgb25lCnVzZWQgYnkgdGhlIGV0aGVybmV0IE5JQywgYW5kIHNvIEknbSBi
ZWluZyBob3BlbGVzc2x5Cm92ZXItY29uc2VydmF0aXZlLiAgUGVyaGFwczsgYnV0IHVudGlsIHdl
IGtub3cgZm9yIHN1cmUsIHVzaW5nIGEKc2ltaWxhciBhbmFseXNpcyB0byB3aGF0IEkgZGVzY3Jp
YmVkIGFib3ZlLCBJJ2QgbXVjaCByYXRoZXIgYmUgc2xvdwp0aGFuIGJlIHBvdGVudGlhbGx5IGlu
c2VjdXJlLgoKVGhlIGppdHRlciAiZW50cm9weSBjb2xsZWN0b3IiIG1heSBiZSBhYmxlIHRvIGdl
bmVyYXRlIG1vcmUKInJhbmRvbW5lc3MiIG11Y2ggbW9yZSBxdWlja2x5LCBidXQgaXMgdGhlIHJl
c3VsdGluZyBudW1iZXJzIHJlYWxseQptb3JlIHNlY3VyZT8gIE90aGVyIHBlb3BsZSB3aWxsIGhh
dmUgdG8ganVkZ2UgZm9yIHRoZW1zZWx2ZXMsIGJ1dCB0aGlzCmlzIHdoeSBJJ20gbm90IGNvbnZp
bmNlZC4KCkJlc3QgcmVnYXJkcywKCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAtIFRlZApfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
XwpUaGUgY3J5cHRvZ3JhcGh5IG1haWxpbmcgbGlzdApjcnlwdG9ncmFwaHlAbWV0emRvd2QuY29t
Cmh0dHA6Ly93d3cubWV0emRvd2QuY29tL21haWxtYW4vbGlzdGluZm8vY3J5cHRvZ3JhcGh5
