nemo
/
hn-classics
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
hn-classics/_stories/2005/12849798.md

1482 lines
58 KiB
Markdown
Raw Permalink Blame History

---
created_at: '2016-11-01T20:35:08.000Z'
title: Randomness Requirements for Security (2005)
url: http://tools.ietf.org/html/rfc4086
author: Tomte
points: 42
story_text:
comment_text:
num_comments: 19
story_id:
story_title:
story_url:
parent_id:
created_at_i: 1478032508
_tags:
- story
- author_Tomte
- story_12849798
objectID: '12849798'
year: 2005
---
BEST CURRENT PRACTICE
Errata
Exist
Network Working Group D. Eastlake, 3rd
Request for Comments: 4086 Motorola Laboratories
BCP: 106 J. Schiller
Obsoletes: 1750 MIT
Category: Best Current Practice S. Crocker
June 2005
Randomness Requirements for Security
Status of This Memo
This document specifies an Internet Best Current Practices for the
Internet Community, and requests discussion and suggestions for
improvements. Distribution of this memo is unlimited.
Copyright Notice
Copyright (C) The Internet Society (2005).
Abstract
Security systems are built on strong cryptographic algorithms that
foil pattern analysis attempts. However, the security of these
systems is dependent on generating secret quantities for passwords,
cryptographic keys, and similar quantities. The use of pseudo-random
processes to generate secret quantities can result in pseudo-
security. A sophisticated attacker may find it easier to reproduce
the environment that produced the secret quantities and to search the
resulting small set of possibilities than to locate the quantities in
the whole of the potential number space.
Choosing random quantities to foil a resourceful and motivated
adversary is surprisingly difficult. This document points out many
pitfalls in using poor entropy sources or traditional pseudo-random
number generation techniques for generating such quantities. It
recommends the use of truly random hardware techniques and shows that
the existing hardware on many systems can be used for this purpose.
It provides suggestions to ameliorate the problem when a hardware
solution is not available, and it gives examples of how large such
quantities need to be for some applications.
Eastlake, et al. Standards Track [Page 1]
``` newpage
RFC 4086 Randomness Requirements for Security June 20051. Introduction and Overview .......................................3
2. General Requirements ............................................4
3. Entropy Sources .................................................7
3.1. Volume Required ............................................7
3.2. Existing Hardware Can Be Used For Randomness ...............8
3.2.1. Using Existing Sound/Video Input ....................8
3.2.2. Using Existing Disk Drives ..........................8
3.3. Ring Oscillator Sources ....................................9
3.4. Problems with Clocks and Serial Numbers ...................10
3.5. Timing and Value of External Events .......................11
3.6. Non-hardware Sources of Randomness ........................12
4. De-skewing .....................................................12
4.1. Using Stream Parity to De-Skew ............................13
4.2. Using Transition Mappings to De-Skew ......................14
4.3. Using FFT to De-Skew ......................................15
4.4. Using Compression to De-Skew ..............................15
5. Mixing .........................................................16
5.1. A Trivial Mixing Function .................................17
5.2. Stronger Mixing Functions .................................18
5.3. Using S-Boxes for Mixing ..................................19
5.4. Diffie-Hellman as a Mixing Function .......................19
5.5. Using a Mixing Function to Stretch Random Bits ............20
5.6. Other Factors in Choosing a Mixing Function ...............20
6. Pseudo-random Number Generators ................................21
6.1. Some Bad Ideas ............................................21
6.1.1. The Fallacy of Complex Manipulation ................21
6.1.2. The Fallacy of Selection from a Large Database .....22
6.1.3. Traditional Pseudo-random Sequences ................23
6.2. Cryptographically Strong Sequences ........................24
6.2.1. OFB and CTR Sequences ..............................25
6.2.2. The Blum Blum Shub Sequence Generator ..............26
6.3. Entropy Pool Techniques ...................................27
7. Randomness Generation Examples and Standards ...................28
7.1. Complete Randomness Generators ............................28
7.1.1. US DoD Recommendations for Password Generation .....28
7.1.2. The /dev/random Device .............................29
7.1.3. Windows CryptGenRandom .............................30
7.2. Generators Assuming a Source of Entropy ...................31
7.2.1. X9.82 Pseudo-Random Number Generation ..............31
7.2.2. X9.17 Key Generation ...............................33
7.2.3. DSS Pseudo-random Number Generation ................34
8. Examples of Randomness Required ................................34
8.1. Password Generation .......................................35
8.2. A Very High Security Cryptographic Key ....................36
9. Conclusion .....................................................38
10. Security Considerations ........................................38
Eastlake, et al. Standards Track [Page 2]
```
``` newpage
RFC 4086 Randomness Requirements for Security June 200511. Acknowledgments ................................................39
Appendix A: Changes from RFC 1750 ..................................40
Informative References .............................................41
1 . Introduction and OverviewSSH] [IPSEC] [TLS] [S/MIME]
[MAIL_PGP*] [DNSSEC*]. For comparison, when the previous version of
this document [RFC1750] was issued in 1994, the only Internet
cryptographic security specification in the IETF was the Privacy
Enhanced Mail protocol [MAIL_PEM*].
These systems provide substantial protection against snooping and
spoofing. However, there is a potential flaw. At the heart of all
cryptographic systems is the generation of secret, unguessable (i.e.,
random) numbers.
The lack of generally available facilities for generating such random
numbers (that is, the lack of general availability of truly
unpredictable sources) forms an open wound in the design of
cryptographic software. For the software developer who wants to
build a key or password generation procedure that runs on a wide
range of hardware, this is a very real problem.
Note that the requirement is for data that an adversary has a very
low probability of guessing or determining. This can easily fail if
pseudo-random data is used that meets only traditional statistical
tests for randomness, or that is based on limited-range sources such
as clocks. Sometimes such pseudo-random quantities can be guessed by
an adversary searching through an embarrassingly small space of
possibilities.
This Best Current Practice document describes techniques for
producing random quantities that will be resistant to attack. It
recommends that future systems include hardware random number
generation or provide access to existing hardware that can be used
for this purpose. It suggests methods for use if such hardware is
not available, and it gives some estimates of the number of random
bits required for sample applications.
Eastlake, et al. Standards Track [Page 3]
```
``` newpage
RFC 4086 Randomness Requirements for Security June 20052 . General RequirementsRFC1948].
Generally speaking, the above examples also illustrate two different
types of random quantities that may be wanted. In the case of
human-usable passwords, the only important characteristic is that
they be unguessable. It is not important that they may be composed
of ASCII characters, so the top bit of every byte is zero, for
example. On the other hand, for fixed length keys and the like, one
normally wants quantities that appear to be truly random, that is,
quantities whose bits will pass statistical randomness tests.
In some cases, such as the use of symmetric encryption with the one-
time pads or an algorithm like the US Advanced Encryption Standard
[AES], the parties who wish to communicate confidentially and/or with
authentication must all know the same secret key. In other cases,
where asymmetric or "public key" cryptographic techniques are used,
keys come in pairs. One key of the pair is private and must be kept
secret by one party; the other is public and can be published to the
world. It is computationally infeasible to determine the private key
from the public key, and knowledge of the public key is of no help to
an adversary [ASYMMETRIC]. See general references [SCHNEIER,
FERGUSON, KAUFMAN].
The frequency and volume of the requirement for random quantities
differs greatly for different cryptographic systems. With pure RSA,
random quantities are required only when a new key pair is generated;
thereafter, any number of messages can be signed without a further
need for randomness. The public key Digital Signature Algorithm
devised by the US National Institute of Standards and Technology
(NIST) requires good random numbers for each signature [DSS]. And
Eastlake, et al. Standards Track [Page 4]
```
``` newpage
RFC 4086 Randomness Requirements for Security June 2005SHANNON]. This depends on the number of
different secret values possible and the probability of each value,
as follows:
-----
\
Bits of information = \ - p * log ( p )
/ i 2 i
/
-----
where i counts from 1 to the number of possible secret values and p
sub i is the probability of the value numbered i. (Because p sub i
is less than one, the log will be negative, so each term in the sum
will be non-negative.)
If there are 2^n different values of equal probability, then n bits
of information are present and an adversary would have to try, on the
average, half of the values, or 2^(n-1), before guessing the secret
quantity. If the probability of different values is unequal, then
there is less information present, and fewer guesses will, on
average, be required by an adversary. In particular, any values that
an adversary can know to be impossible or of low probability can be
initially ignored by the adversary, who will search through the more
probable values first.
For example, consider a cryptographic system that uses 128-bit keys.
If these keys are derived using a fixed pseudo-random number
generator that is seeded with an 8-bit seed, then an adversary needs
to search through only 256 keys (by running the pseudo-random number
generator with every possible seed), not 2^128 keys as may at first
appear to be the case. Only 8 bits of "information" are in these
128-bit keys.
Eastlake, et al. Standards Track [Page 5]
```
``` newpage
RFC 4086 Randomness Requirements for Security June 2005LUBY].
Statistically tested randomness in the traditional sense is NOT the
same as the unpredictability required for security use.
For example, the use of a widely available constant sequence, such as
the random table from the CRC Standard Mathematical Tables, is very
weak against an adversary. An adversary who learns of or guesses it
can easily break all security, future and past, based on the sequence
[CRC]. As another example, using AES with a constant key to encrypt
successive integers such as 1, 2, 3, ... will produce output that
also has excellent statistical randomness properties but is
predictable. On the other hand, taking successive rolls of a six-
sided die and encoding the resulting values in ASCII would produce
statistically poor output with a substantial unpredictable component.
So note that passing or failing statistical tests doesn't reveal
whether something is unpredictable or predictable.
Eastlake, et al. Standards Track [Page 6]
```
``` newpage
RFC 4086 Randomness Requirements for Security June 20053 . Entropy Sources6 and 7, after being de-skewed
or mixed as necessary, as described in Sections 4 and 5.
Is there any hope for true, strong, portable randomness in the
future? There might be. All that's needed is a physical source of
unpredictable numbers.
Thermal noise (sometimes called Johnson noise in integrated circuits)
or a radioactive decay source and a fast, free-running oscillator
would do the trick directly [GIFFORD]. This is a trivial amount of
hardware, and it could easily be included as a standard part of a
computer system's architecture. Most audio (or video) input devices
are usable [TURBID]. Furthermore, any system with a spinning disk or
ring oscillator and a stable (crystal) time source or the like has an
adequate source of randomness ([DAVIS] and Section 3.3). All that's
needed is the common perception among computer vendors that this
small additional hardware and the software to access it is necessary
and useful.
ANSI X9 is currently developing a standard that includes a part
devoted to entropy sources. See Part 2 of [X9.82].
3.1 . Volume RequiredSection 8, even the
highest security system is unlikely to require strong keying material
of much over 200 bits. If a series of keys is needed, they can be
generated from a strong random seed (starting value) using a
cryptographically strong sequence, as explained in Section 6.2. A
few hundred random bits generated at start-up or once a day is enough
if such techniques are used. Even if the random bits are generated
as slowly as one per second and it is not possible to overlap the
generation process, it should be tolerable in most high-security
applications to wait 200 seconds occasionally.
These numbers are trivial to achieve. It could be achieved by a
person repeatedly tossing a coin, and almost any hardware based
process is likely to be much faster.
Eastlake, et al. Standards Track [Page 7]
```
``` newpage
RFC 4086 Randomness Requirements for Security June 20053.2 . Existing Hardware Can Be Used For Randomness3.2.1 . Using Existing Sound/Video InputSection 4),
one can generate a huge amount of medium-quality random data with the
UNIX-style command line:
cat /dev/audio | compress - >random-bits-file
A detailed examination of this type of randomness source appears in
[TURBID].
3.2.2 . Using Existing Disk DrivesDAVIS, Jakobsson]. The addition of
low-level disk seek-time instrumentation produces a series of
measurements that contain this randomness. Such data is usually
highly correlated, so significant processing is needed, as described
in Section 5.2 below. Nevertheless, experimentation a decade ago
showed that, with such processing, even slow disk drives on the
slower computers of that day could easily produce 100 bits a minute
or more of excellent random data.
Every increase in processor speed, which increases the resolution
with which disk motion can be timed or increases the rate of disk
seeks, increases the rate of random bit generation possible with this
technique. At the time of this paper and with modern hardware, a
more typical rate of random bit production would be in excess of
Eastlake, et al. Standards Track [Page 8]
```
``` newpage
RFC 4086 Randomness Requirements for Security June 20053.3 . Ring Oscillator SourcesSection 4). An engineering study
would be needed to determine the amount of entropy being produced
depending on the particular design. In any case, these can be good
sources whose cost is a trivial amount of hardware by modern
standards.
As an example, IEEE 802.11i suggests the circuit below, with due
attention in the design to isolation of the rings from each other and
from clocked circuits to avoid undesired synchronization, etc., and
with extensive post processing [IEEE_802.11i].
Eastlake, et al. Standards Track [Page 9]
```
``` newpage
RFC 4086 Randomness Requirements for Security June 20053.4 . Problems with Clocks and Serial NumbersEastlake, et al. Standards Track [Page 10]
```
``` newpage
RFC 4086 Randomness Requirements for Security June 20053.5 . Timing and Value of External EventsEastlake, et al. Standards Track [Page 11]
```
``` newpage
RFC 4086 Randomness Requirements for Security June 20053.6 . Non-hardware Sources of Randomness4 . De-skewingEastlake, et al. Standards Track [Page 12]
```
``` newpage
RFC 4086 Randomness Requirements for Security June 2005section 5.2,
there are much stronger techniques that extract more of the available
entropy.
4.2 . Using Transition Mappings to De-SkewVON_NEUMANN], is to
examine a bit stream as a sequence of non-overlapping pairs. One
could then discard any 00 or 11 pairs found, interpret 01 as a 0 and
10 as a 1. Assume that the probability of a 1 is 0.5+E and that the
probability of a 0 is 0.5-E, where E is the eccentricity of the
source as described in the previous section. Then the probability of
each pair is shown in the following table:
+------+-----------------------------------------+
| pair | probability |
+------+-----------------------------------------+
| 00 | (0.5 - E)^2 = 0.25 - E + E^2 |
| 01 | (0.5 - E)*(0.5 + E) = 0.25 - E^2 |
| 10 | (0.5 + E)*(0.5 - E) = 0.25 - E^2 |
| 11 | (0.5 + E)^2 = 0.25 + E + E^2 |
+------+-----------------------------------------+
Eastlake, et al. Standards Track [Page 14]
```
``` newpage
RFC 4086 Randomness Requirements for Security June 20054.3 . Using FFT to De-Skewsection 5.2 below.
Using the Fourier transform of the data or its optimized variant, the
FFT, is interesting primarily for theoretical reasons. It can be
shown that this technique will discard strong correlations. If
adequate data is processed and if remaining correlations decay,
spectral lines that approach statistical independence and normally
distributed randomness can be produced [BRILLINGER].
4.4 . Using Compression to De-SkewSection 2 for
the amount of information in a sequence. Since the compression is
reversible, the same amount of information must be present in the
shorter output as was present in the longer input. By the Shannon
information equation, this is only possible if, on average, the
probabilities of the different shorter sequences are more uniformly
distributed than were the probabilities of the longer sequences.
Therefore, the shorter sequences must be de-skewed relative to the
input.
Eastlake, et al. Standards Track [Page 15]
```
``` newpage
RFC 4086 Randomness Requirements for Security June 2005Section 5.2. At a minimum, the
beginning of the compressed sequence should be skipped and only later
bits should used for applications requiring roughly-random bits.
5 . MixingSection 3, and mixed them as described in this section, one has a
strong seed. This can then be used to produce large quantities of
cryptographically strong material as described in Sections 6 and 7.
A strong mixing function is one that combines inputs and produces an
output in which each output bit is a different complex non-linear
function of all the input bits. On average, changing any input bit
will change about half the output bits. But because the relationship
is complex and non-linear, no particular output bit is guaranteed to
change when any particular input bit is changed.
Consider the problem of converting a stream of bits that is skewed
towards 0 or 1 or which has a somewhat predictable pattern to a
shorter stream which is more random, as discussed in Section 4. This
is simply another case where a strong mixing function is desired, to
mix the input bits and produce a smaller number of output bits. The
technique given in Section 4.1, using the parity of a number of bits,
is simply the result of successively XORing them. This is examined
as a trivial mixing function, immediately below. Use of stronger
mixing functions to extract more of the randomness in a stream of
skewed bits is examined in Section 5.2. See also [NASLUND].
Eastlake, et al. Standards Track [Page 16]
```
``` newpage
RFC 4086 Randomness Requirements for Security June 20055.1 . A Trivial Mixing FunctionSection
4.1 above, then the output eccentricity relates to the input
eccentricity as follows:
E = 2 * E * E
output input 1 input 2
Since E is never greater than 1/2, the eccentricity is always
improved, except in the case in which at least one input is a totally
skewed constant. This is illustrated in the following table, where
the top and left side values are the two input eccentricities and the
entries are the output eccentricity:
+--------+--------+--------+--------+--------+--------+--------+
| E | 0.00 | 0.10 | 0.20 | 0.30 | 0.40 | 0.50 |
+--------+--------+--------+--------+--------+--------+--------+
| 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 |
| 0.10 | 0.00 | 0.02 | 0.04 | 0.06 | 0.08 | 0.10 |
| 0.20 | 0.00 | 0.04 | 0.08 | 0.12 | 0.16 | 0.20 |
| 0.30 | 0.00 | 0.06 | 0.12 | 0.18 | 0.24 | 0.30 |
| 0.40 | 0.00 | 0.08 | 0.16 | 0.24 | 0.32 | 0.40 |
| 0.50 | 0.00 | 0.10 | 0.20 | 0.30 | 0.40 | 0.50 |
+--------+--------+--------+--------+--------+--------+--------+
However, note that the above calculations assume that the inputs are
not correlated. If the inputs were, say, the parity of the number of
minutes from midnight on two clocks accurate to a few seconds, then
each might appear random if sampled at random intervals much longer
Eastlake, et al. Standards Track [Page 17]
```
``` newpage
RFC 4086 Randomness Requirements for Security June 20055.2 . Stronger Mixing FunctionsAES] is an example of
a strong mixing function for multiple bit quantities. It takes up to
384 bits of input (128 bits of "data" and 256 bits of "key") and
produces 128 bits of output, each of which is dependent on a complex
non-linear function of all input bits. Other encryption functions
with this characteristic, such as [DES], can also be used by
considering them to mix all of their key and data input bits.
Another good family of mixing functions is the "message digest" or
hashing functions such as the US Government Secure Hash Standards
[SHA*] and the MD4, MD5 [MD4, MD5] series. These functions all take
a practically unlimited amount of input and produce a relatively
short fixed-length output mixing all the input bits. The MD* series
produces 128 bits of output, SHA-1 produces 160 bits, and other SHA
functions produce up to 512 bits.
Although the message digest functions are designed for variable
amounts of input, AES and other encryption functions can also be used
to combine any number of inputs. If 128 bits of output is adequate,
the inputs can be packed into a 128-bit data quantity and successive
AES "keys", padding with zeros if needed; the quantity is then
successively encrypted by the "keys" using AES in Electronic Codebook
Mode. Alternatively, the input could be packed into one 128-bit key
and multiple data blocks and a CBC-MAC could be calculated [MODES].
More complex mixing should be used if more than 128 bits of output
are needed and one wants to employ AES (but note that it is
absolutely impossible to get more bits of "randomness" out than are
put in). For example, suppose that inputs are packed into three
quantities, A, B, and C. One may use AES to encrypt A with B and
then with C as keys to produce the first part of the output, then
encrypt B with C and then A for more output and, if necessary,
encrypt C with A and then B for yet more output. Still more output
can be produced by reversing the order of the keys given above. The
same can be done with the hash functions, hashing various subsets of
the input data or different copies of the input data with different
prefixes and/or suffixes to produce multiple outputs.
For an example of using a strong mixing function, reconsider the case
of a string of 308 bits, each of which is biased 99% toward zero.
The parity technique given in Section 4.1 reduces this to one bit,
with only a 1/1000 deviance from being equally likely a zero or one.
But, applying the equation for information given in Section 2, this
Eastlake, et al. Standards Track [Page 18]
```
``` newpage
RFC 4086 Randomness Requirements for Security June 20055.3 . Using S-Boxes for MixingSBOX1, SBOX2].
5.4 . Diffie-Hellman as a Mixing FunctionD-H].
If these initial quantities are random and uncorrelated, then the
shared secret combines their entropy but, of course, can not produce
more randomness than the size of the shared secret generated.
Although this is true if the Diffie-Hellman computation is performed
privately, an adversary who can observe either of the public keys and
knows the modulus being used need only search through the space of
the other secret key in order to be able to calculate the shared
secret [D-H]. So, conservatively, it would be best to consider
public Diffie-Hellman to produce a quantity whose guessability
corresponds to the worse of the two inputs. Because of this and the
fact that Diffie-Hellman is computationally intensive, its use as a
mixing function is not recommended.
Eastlake, et al. Standards Track [Page 19]
```
``` newpage
RFC 4086 Randomness Requirements for Security June 20055.5 . Using a Mixing Function to Stretch Random BitsSection 5.1 shows that mixing a random bit with a
constant bit with Exclusive Or will produce a random bit. While this
is true, it does not provide a way to "stretch" one random bit into
more than one. If, for example, a random bit is mixed with a 0 and
then with a 1, this produces a two bit sequence but it will always be
either 01 or 10. Since there are only two possible values, there is
still only the one bit of original randomness.
5.6 . Other Factors in Choosing a Mixing FunctionEastlake, et al. Standards Track [Page 20]
```
``` newpage
RFC 4086 Randomness Requirements for Security June 20056 . Pseudo-random Number GeneratorsSection 3 and possibly de-skewed and mixed as described in Sections 4
and 5, one can algorithmically extend that seed to produce a large
number of cryptographically-strong random quantities. Such
algorithms are platform independent and can operate in the same
fashion on any computer. For the algorithms to be secure, their
input and internal workings must be protected from adversarial
observation.
The design of such pseudo-random number generation algorithms, like
the design of symmetric encryption algorithms, is not a task for
amateurs. Section 6.1 below lists a number of bad ideas that failed
algorithms have used. To learn what works, skip Section 6.1 and just
read the remainder of this section and Section 7, which describes and
references some standard pseudo random number generation algorithms.
See Section 7 and Part 3 of [X9.82].
6.1 . Some Bad Ideas6.1.1 . The Fallacy of Complex ManipulationEastlake, et al. Standards Track [Page 21]
```
``` newpage
RFC 4086 Randomness Requirements for Security June 2005KNUTH], where the author describes a
complex algorithm. It was intended that the machine language program
corresponding to the algorithm would be so complicated that a person
trying to read the code without comments wouldn't know what the
program was doing. Unfortunately, actual use of this algorithm
showed that it almost immediately converged to a single repeated
value in one case and a small cycle of values in another case.
Not only does complex manipulation not help you if you have a limited
range of seeds, but blindly-chosen complex manipulation can destroy
the entropy in a good seed!
6.1.2 . The Fallacy of Selection from a Large DatabaseUSENET_1, USENET_2]. Assume that a
random quantity was selected by fetching 32 bytes of data from a
random starting point in this data. This does not yield 32*8 = 256
bits worth of unguessability. Even if much of the data is human
language that contains no more than 2 or 3 bits of information per
byte, it doesn't yield 32*2 = 64 bits of unguessability. For an
adversary with access to the same Usenet database, the unguessability
rests only on the starting point of the selection. That is perhaps a
little over a couple of dozen bits of unguessability.
The same argument applies to selecting sequences from the data on a
publicly available CD/DVD recording or any other large public
database. If the adversary has access to the same database, this
"selection from a large volume of data" step buys little. However,
if a selection can be made from data to which the adversary has no
access, such as system buffers on an active multi-user system, it may
be of help.
Eastlake, et al. Standards Track [Page 22]
```
``` newpage
RFC 4086 Randomness Requirements for Security June 20056.1.3 . Traditional Pseudo-random SequencesKNUTH] has a classic exposition on pseudo-random numbers.
Applications he mentions are simulations of natural phenomena,
sampling, numerical analysis, testing computer programs, decision
making, and games. None of these have the same characteristics as
the sorts of security uses we are talking about. Only in the last
two could there be an adversary trying to find the random quantity.
However, in these cases, the adversary normally has only a single
chance to use a guessed value. In guessing passwords or attempting
to break an encryption scheme, the adversary normally has many,
perhaps unlimited, chances at guessing the correct value. Sometimes
the adversary can store the message to be broken and repeatedly
attack it. Adversaries are also be assumed to be aided by a
computer.
For testing the "randomness" of numbers, Knuth suggests a variety of
measures, including statistical and spectral. These tests check
things like autocorrelation between different parts of a "random"
sequence or distribution of its values. But these tests could be met
by a constant stored random sequence, such as the "random" sequence
printed in the CRC Standard Mathematical Tables [CRC]. Despite
meeting all the tests suggested by Knuth, that sequence is unsuitable
for cryptographic us, as adversaries must be assumed to have copies
of all commonly published "random" sequences and to be able to spot
the source and predict future values.
A typical pseudo-random number generation technique is the linear
congruence pseudo-random number generator. This technique uses
modular arithmetic, where the value numbered N+1 is calculated from
the value numbered N by
V = ( V * a + b )(Mod c)
N+1 N
The above technique has a strong relationship to linear shift
register pseudo-random number generators, which are well understood
cryptographically [SHIFT*]. In such generators, bits are introduced
at one end of a shift register as the Exclusive Or (binary sum
without carry) of bits from selected fixed taps into the register.
For example, consider the following:
Eastlake, et al. Standards Track [Page 23]
```
``` newpage
RFC 4086 Randomness Requirements for Security June 2005SCHNEIER, STERN]. For example, with
the generators above, one can determine V(n+1) given knowledge of
V(n). In fact, it has been shown that with these techniques, even if
only one bit of the pseudo-random values are released, the seed can
be determined from short sequences.
Not only have linear congruent generators been broken, but techniques
are now known for breaking all polynomial congruent generators
[KRAWCZYK].
6.2 . Cryptographically Strong SequencesFERGUSON, SCHNEIER],
and not to reveal the complete state of the generator in the sequence
elements. If each value in the sequence can be calculated in a fixed
Eastlake, et al. Standards Track [Page 24]
```
``` newpage
RFC 4086 Randomness Requirements for Security June 20056.2.1 . OFB and CTR SequencesMODES].
An example is shown below in which shifting and masking are used to
combine part of the output feedback with part of the old input. This
type of partial feedback should be avoided for reasons described
below.
Eastlake, et al. Standards Track [Page 25]
```
``` newpage
RFC 4086 Randomness Requirements for Security June 2005Section 6.1.3, but with the all-
important difference that the feedback is determined by a complex
non-linear function of all bits rather than by a simple linear or
polynomial combination of output from a few bit position taps.
Donald W. Davies showed that this sort of shifted partial output
feedback significantly weakens an algorithm, compared to feeding all
the output bits back as input. In particular, for DES, repeatedly
encrypting a full 64-bit quantity will give an expected repeat in
about 2^63 iterations. Feeding back anything less than 64 (and more
than 0) bits will give an expected repeat in between 2^31 and 2^32
iterations!
To predict values of a sequence from others when the sequence was
generated by these techniques is equivalent to breaking the
cryptosystem or to inverting the "non-invertible" hashing with only
partial information available. The less information revealed in each
iteration, the harder it will be for an adversary to predict the
sequence. Thus it is best to use only one bit from each value. It
has been shown that in some cases this makes it impossible to break a
system even when the cryptographic system is invertible and could be
broken if all of each generated value were revealed.
6.2.2 . The Blum Blum Shub Sequence GeneratorBBS]. It is also very simple and is based on quadratic
residues. Its only disadvantage is that it is computationally
intensive compared to the traditional techniques given in Section
6.1.3. This is not a major drawback if it is used for moderately-
infrequent purposes, such as generating session keys.
Eastlake, et al. Standards Track [Page 26]
```
``` newpage
RFC 4086 Randomness Requirements for Security June 20056.3 . Entropy Pool Techniques7.1.2 and 7.1.3 utilize the technique of maintaining a
"pool" of bits and providing operations for strongly mixing input
with some randomness into the pool and extracting pseudo-random bits
from the pool. This is illustrated in the figure below.
Eastlake, et al. Standards Track [Page 27]
```
``` newpage
RFC 4086 Randomness Requirements for Security June 2005RSA_BULL1] for similar
suggestions.
7 . Randomness Generation Examples and Standardssection 7.1, include an entropy source.
Others, described in section 7.2, provide the pseudo-random number
strong-sequence generator but assume the input of a random seed or
input from a source of entropy.
7.1 . Complete Randomness GeneratorsDES]. The third is
a more modern and stronger standard based on SHA-1 [SHA*]. Lastly,
the widely deployed modern UNIX and Windows random number generators
are described.
7.1.1 . US DoD Recommendations for Password GenerationDoD]. It suggests using the US Data
Encryption Standard [DES] in Output Feedback Mode [MODES] as follows:
Eastlake, et al. Standards Track [Page 28]
```
``` newpage
RFC 4086 Randomness Requirements for Security June 20057.1.2 . The /dev/random DeviceEastlake, et al. Standards Track [Page 29]
```
``` newpage
RFC 4086 Randomness Requirements for Security June 20057.1.3 . Windows CryptGenRandomEastlake, et al. Standards Track [Page 30]
```
``` newpage
RFC 4086 Randomness Requirements for Security June 2005WSC].
7.2 . Generators Assuming a Source of EntropySection
6.2) from that seed.
7.2.1 . X9.82 Pseudo-Random Number GenerationRFC2104]. The
draft version of this generator is described below, omitting a number
of optional features [X9.82].
In the subsections below, the HMAC hash construct is simply referred
to as HMAC but, of course, a particular standard SHA function must be
selected in an particular use. Generally speaking, if the strength
of the pseudo-random values to be generated is to be N bits, the SHA
function chosen must generate N or more bits of output, and a source
of at least N bits of input entropy will be required. The same hash
function must be used throughout an instantiation of this generator.
Eastlake, et al. Standards Track [Page 31]
```
``` newpage
RFC 4086 Randomness Requirements for Security June 20057.2.2 . X9.17 Key GenerationX9.17]:
s is the initial 64 bit seed.
0
g is the sequence of generated 64-bit key quantities
n
k is a random key reserved for generating this key sequence.
t is the time at which a key is generated, to as fine a resolution
as is available (up to 64 bits).
DES ( K, Q ) is the DES encryption of quantity Q with key K.
Then:
g = DES ( k, DES ( k, t ) XOR s )
n n
s = DES ( k, DES ( k, t ) XOR g )
n+1 n
If g sub n is to be used as a DES key, then every eighth bit should
be adjusted for parity for that use, but the entire 64 bit unmodified
g should be used in calculating the next s.
Eastlake, et al. Standards Track [Page 33]
```
``` newpage
RFC 4086 Randomness Requirements for Security June 20057.2.3 . DSS Pseudo-random Number GenerationDSS] provides a
method of producing a sequence of pseudo-random 160 bit quantities
for use as private keys or the like. This has been modified by
Change Notice 1 [DSS_CN1] to produce the following algorithm for
generating general-purpose pseudo-random numbers:
t = 0x 67452301 EFCDAB89 98BADCFE 10325476 C3D2E1F0
XKEY = initial seed
0
For j = 0 to ...
XVAL = ( XKEY + optional user input ) (Mod 2^512)
j
X = G( t, XVAL )
j
XKEY = ( 1 + XKEY + X ) (Mod 2^512)
j+1 j j
The quantities X thus produced are the pseudo-random sequence of
160-bit values. Two functions can be used for "G" above. Each
produces a 160-bit value and takes two arguments, a 160-bit value and
a 512 bit value.
The first is based on SHA-1 and works by setting the 5 linking
variables, denoted H with subscripts in the SHA-1 specification, to
the first argument divided into fifths. Then steps (a) through (e)
of section 7 of the NIST SHA-1 specification are run over the second
argument as if it were a 512-bit data block. The values of the
linking variable after those steps are then concatenated to produce
the output of G [SHA*].
As an alternative method, NIST also defined an alternate G function
based on multiple applications of the DES encryption function [DSS].
8 . Examples of Randomness RequiredEastlake, et al. Standards Track [Page 34]
```
``` newpage
RFC 4086 Randomness Requirements for Security June 2005ORMAN] and [RSA_BULL13] provide information on the
public key lengths that should be used for exchanging symmetric keys.
8.1 . Password Generationsection 7.1). Using a list of 1,000
words, the password could be expressed as a three-word phrase
(1,000,000,000 possibilities). By using case-insensitive letters and
digits, six characters would suffice ((26+10)^6 = 2,176,782,336
possibilities).
For a higher-security password, the number of bits required goes up.
To decrease the probability by 1,000 requires increasing the universe
of passwords by the same factor, which adds about 10 bits. Thus, to
have only a one in a million chance of a password being guessed under
the above scenario would require 39 bits of randomness and a password
that was a four-word phrase from a 1,000 word list, or eight
letters/digits. To go to a one-in-10^9 chance, 49 bits of randomness
are needed, implying a five-word phrase or a ten-letter/digit
password.
In a real system, of course, there are other factors. For example,
the larger and harder to remember passwords are, the more likely
users will bed to write them down, resulting in an additional risk of
compromise.
Eastlake, et al. Standards Track [Page 35]
```
``` newpage
RFC 4086 Randomness Requirements for Security June 20058.2 . A Very High Security Cryptographic Key8.2.1 . Effort per Key TrialKeyStudy] that was sponsored by the Business Software Alliance. It
concluded that a reasonable key length in 1995 for very high security
is in the range of 75 to 90 bits and, since the cost of cryptography
does not vary much with the key size, it recommends 90 bits. To
update these recommendations, just add 2/3 of a bit per year for
Moore's law [MOORE]. This translates to a determination, in the year
2004, a reasonable key length is in the 81- to 96-bit range. In
fact, today, it is increasingly common to use keys longer than 96
Eastlake, et al. Standards Track [Page 36]
```
``` newpage
RFC 4086 Randomness Requirements for Security June 20058.2.2 . Meet-in-the-Middle AttacksKeyStudy]
analysis.
This amount of randomness is well beyond the limit of that in the
inputs recommended by the US DoD for password generation and could
require user-typing timing, hardware random number generation, or
other sources of randomness.
The meet-in-the-middle attack assumes that the cryptographic
algorithm can be decomposed in this way. Hopefully no modern
algorithm has this weakness, but there may be cases where we are not
sure of that or even of what algorithm a key will be used with. Even
if a basic algorithm is not subject to a meet-in-the-middle attack,
an attempt to produce a stronger algorithm by applying the basic
algorithm twice (or two different algorithms sequentially) with
different keys will gain less added security than would be expected.
Such a composite algorithm would be subject to a meet-in-the-middle
attack.
Enormous resources may be required to mount a meet-in-the-middle
attack, but they are probably within the range of the national
security services of a major nation. Essentially all nations spy on
other nations' traffic.
Eastlake, et al. Standards Track [Page 37]
```
``` newpage
RFC 4086 Randomness Requirements for Security June 20058.2.3 . Other ConsiderationsKeyStudy] also considers the possibilities of special-purpose code-
breaking hardware and having an adequate safety margin.
Note that key length calculations such as those above are
controversial and depend on various assumptions about the
cryptographic algorithms in use. In some cases, a professional with
a deep knowledge of algorithm-breaking techniques and of the strength
of the algorithm in use could be satisfied with less than half of the
192 bit key size derived above.
For further examples of conservative design principles, see
[FERGUSON].
9 . Conclusion10 . Security ConsiderationsEastlake, et al. Standards Track [Page 38]
```
``` newpage
RFC 4086 Randomness Requirements for Security June 200511 . AcknowledgementsRFC 1750,
the predecessor of this document:
David M. Balenson, Don T. Davis, Carl Ellison, Marc Horowitz,
Christian Huitema, Charlie Kaufman, Steve Kent, Hal Murray, Neil
Haller, Richard Pitkin, Tim Redmond, and Doug Tygar.
Eastlake, et al. Standards Track [Page 39]
```
``` newpage
RFC 4086 Randomness Requirements for Security June 2005RFC 1750
1. Additional acknowledgements have been added.
2. Insertion of section 5.3 on mixing with S-boxes.
3. Addition of section 3.3 on Ring Oscillator randomness sources.
4. Addition of AES and the members of the SHA series producing more
than 160 bits. Use of AES has been emphasized and the use of DES
de-emphasized.
5. Addition of section 6.3 on entropy pool techniques.
6. Addition of section 7.2.3 on the pseudo-random number generation
techniques given in FIPS 186-2 (with Change Notice 1), 7.2.1 on
those given in X9.82, section 7.1.2 on the random number
generation techniques of the /dev/random device in Linux and other
UNIX systems, and section 7.1.3 on random number generation
techniques in the Windows operating system.
7. Addition of references to the "Minimal Key Lengths for Symmetric
Ciphers to Provide Adequate Commercial Security" study published
in January 1996 [KeyStudy] and to [RFC1948].
8. Added caveats to using Diffie-Hellman as a mixing function and,
because of those caveats and its computationally intensive nature,
recommend against its use.
9. Addition of references to the X9.82 effort and the [TURBID] and
[NASLUND] papers.
10. Addition of discussion of min-entropy and Renyi entropy and
references to the [LUBY] book.
11. Major restructuring, minor wording changes, and a variety of
reference updates.
Eastlake, et al. Standards Track [Page 40]
```
``` newpage
RFC 4086 Randomness Requirements for Security June 2005AES] "Specification of the Advanced Encryption Standard
(AES)", United States of America, US National
Institute of Standards and Technology, FIPS 197,
November 2001.
[ASYMMETRIC] Simmons, G., Ed., "Secure Communications and
Asymmetric Cryptosystems", AAAS Selected Symposium
69, ISBN 0-86531-338-5, Westview Press, 1982.
[BBS] Blum, L., Blum, M., and M. Shub, "A Simple
Unpredictable Pseudo-Random Number Generator", SIAM
Journal on Computing, v. 15, n. 2, 1986.
[BRILLINGER] Brillinger, D., "Time Series: Data Analysis and
Theory", Holden-Day, 1981.
[CRC] "C.R.C. Standard Mathematical Tables", Chemical
Rubber Publishing Company.
[DAVIS] Davis, D., Ihaka, R., and P. Fenstermacher,
"Cryptographic Randomness from Air Turbulence in Disk
Drives", Advances in Cryptology - Crypto '94,
Springer-Verlag Lecture Notes in Computer Science
#839, 1984.
[DES] "Data Encryption Standard", US National Institute of
Standards and Technology, FIPS 46-3, October 1999.
Also, "Data Encryption Algorithm", American National
Standards Institute, ANSI X3.92-1981. See also FIPS
112, "Password Usage", which includes FORTRAN code
for performing DES.
[D-H] Rescorla, E., "Diffie-Hellman Key Agreement Method",
RFC 2631, June 1999.
[DNSSEC1] Arends, R., Austein, R., Larson, M., Massey, D., and
S. Rose, "DNS Security Introduction and
Requirements", RFC 4033, March 2005.
[DNSSEC2] Arends, R., Austein, R., Larson, M., Massey, D., and
S. Rose, "Resource Records for the DNS Security
Extensions", RFC 4034, March 2005.
[DNSSEC3] Arends, R., Austein, R., Larson, M., Massey, D., and
S. Rose, "Protocol Modifications for the DNS Security
Extensions", RFC 4035, March 2005.
Eastlake, et al. Standards Track [Page 41]
```
``` newpage
RFC 4086 Randomness Requirements for Security June 2005DoD] "Password Management Guideline", United States of
America, Department of Defense, Computer Security
Center, CSC-STD-002-85, April 1885.
(See also "Password Usage", FIPS 112, which
incorporates CSC-STD-002-85 as one of its appendices.
FIPS 112 is currently available at:
http://www.idl.nist.gov/fipspubs/fip112.htm.)
[DSS] "Digital Signature Standard (DSS)", US National
Institute of Standards and Technology, FIPS 186-2,
January 2000.
[DSS_CN1] "Digital Signature Standard Change Notice 1", US
National Institute of Standards and Technology, FIPS
186-2 Change Notice 1, 5, October 2001.
[FERGUSON] Ferguson, N. and B. Schneier, "Practical
Cryptography", Wiley Publishing Inc., ISBN
047122894X, April 2003.
[GIFFORD] Gifford, D., "Natural Random Number", MIT/LCS/TM-371,
September 1988.
[IEEE_802.11i] "Amendment to Standard for Telecommunications and
Information Exchange Between Systems - LAN/MAN
Specific Requirements - Part 11: Wireless Medium
Access Control (MAC) and physical layer (PHY)
specifications: Medium Access Control (MAC) Security
Enhancements", IEEE, January 2004.
[IPSEC] Kent, S. and R. Atkinson, "Security Architecture for
the Internet Protocol", RFC 2401, November 1998.
[Jakobsson] Jakobsson, M., Shriver, E., Hillyer, B., and A.
Juels, "A practical secure random bit generator",
Proceedings of the Fifth ACM Conference on Computer
and Communications Security, 1998.
[KAUFMAN] Kaufman, C., Perlman, R., and M. Speciner, "Network
Security: Private Communication in a Public World",
Prentis Hall PTR, ISBN 0-13-046019-2, 2nd Edition
2002.
Eastlake, et al. Standards Track [Page 42]
```
``` newpage
RFC 4086 Randomness Requirements for Security June 2005RFC2104] Krawczyk, H., Bellare, M., and R. Canetti, "HMAC:
Keyed-Hashing for Message Authentication", RFC 2104,
February 1997.
[RSA_BULL1] "Suggestions for Random Number Generation in
Software", RSA Laboratories Bulletin #1, January
1996.
[RSA_BULL13] Silverman, R., "A Cost-Based Security Analysis of
Symmetric and Asymmetric Key Lengths", RSA
Laboratories Bulletin #13, April 2000 (revised
November 2001).
[SBOX1] Mister, S. and C. Adams, "Practical S-box Design",
Selected Areas in Cryptography, 1996.
[SBOX2] Nyberg, K., "Perfect Non-linear S-boxes", Advances in
Cryptography, Eurocrypt '91 Proceedings, Springer-
Verland, 1991.
[SCHNEIER] Schneier, B., "Applied Cryptography: Protocols,
Algorithms, and Source Code in C", 2nd Edition, John
Wiley & Sons, 1996.
[SHANNON] Shannon, C., "The Mathematical Theory of
Communication", University of Illinois Press, 1963.
Originally from: Bell System Technical Journal, July
and October, 1948.
[SHIFT1] Golub, S., "Shift Register Sequences", Aegean Park
Press, Revised Edition, 1982.
[SHIFT2] Barker, W., "Cryptanalysis of Shift-Register
Generated Stream Cypher Systems", Aegean Park Press,
1984.
[SHA] "Secure Hash Standard", US National Institute of
Science and Technology, FIPS 180-2, 1 August 2002.
[SHA_RFC] Eastlake 3rd, D. and P. Jones, "US Secure Hash
Algorithm 1 (SHA1)", RFC 3174, September 2001.
[SSH] Products of the SECSH Working Group, Works in
Progress, 2005.
[STERN] Stern, J., "Secret Linear Congruential Generators are
not Cryptographically Secure", Proc. IEEE STOC, 1987.
Eastlake, et al. Standards Track [Page 45]
```
``` newpage
RFC 4086 Randomness Requirements for Security June 2005TLS] Dierks, T. and C. Allen, "The TLS Protocol Version
1.0", RFC 2246, January 1999.
[TURBID] Denker, J., "High Entropy Symbol Generator",
<http://www.av8n.com/turbid/paper/turbid.htm>, 2003.
[USENET_1] Kantor, B. and P. Lapsley, "Network News Transfer
Protocol", RFC 977, February 1986.
[USENET_2] Barber, S., "Common NNTP Extensions", RFC 2980,
October 2000.
[VON_NEUMANN] Von Nuemann, J., "Various techniques used in
connection with random digits", Von Neumann's
Collected Works, Vol. 5, Pergamon Press, 1963.
[WSC] Howard, M. and D. LeBlanc, "Writing Secure Code,
Second Edition", Microsoft Press, ISBN 0735617228,
December 2002.
[X9.17] "American National Standard for Financial Institution
Key Management (Wholesale)", American Bankers
Association, 1985.
[X9.82] "Random Number Generation", American National
Standards Institute, ANSI X9F1, Work in Progress.
Part 1 - Overview and General Principles.
Part 2 - Non-Deterministic Random Bit Generators
Part 3 - Deterministic Random Bit Generators
Eastlake, et al. Standards Track [Page 46]
```
``` newpage
RFC 4086 Randomness Requirements for Security June 2005Eastlake, et al. Standards Track [Page 47]
```
``` newpage
RFC 4086 Randomness Requirements for Security June 2005BCP 78, and except as set forth therein, the authors
retain all their rights.
This document and the information contained herein are provided on an
"AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET
ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED,
INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE
INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Intellectual Property
The IETF takes no position regarding the validity or scope of any
Intellectual Property Rights or other rights that might be claimed to
pertain to the implementation or use of the technology described in
this document or the extent to which any license under such rights
might or might not be available; nor does it represent that it has
made any independent effort to identify any such rights. Information
on the procedures with respect to rights in RFC documents can be
found in BCP 78 and BCP 79.
Copies of IPR disclosures made to the IETF Secretariat and any
assurances of licenses to be made available, or the result of an
attempt made to obtain a general license or permission for the use of
such proprietary rights by implementers or users of this
specification can be obtained from the IETF on-line IPR repository at
http://www.ietf.org/ipr.
The IETF invites any interested party to bring to its attention any
copyrights, patents or patent applications, or other proprietary
rights that may cover technology that may be required to implement
this standard. Please address the information to the IETF at ietf-
ipr@ietf.org.
Acknowledgement
Funding for the RFC Editor function is currently provided by the
Internet Society.
Eastlake, et al. Standards Track [Page 48]
```
Html markup produced by rfcmarkup 1.126, available from
<https://tools.ietf.org/tools/rfcmarkup/>
Reference in New Issue View Git Blame Copy Permalink