<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">On Mon, 28 Oct 2013 21:05:13 David Mercer wrote<blockquote type="cite">Date: Mon, 28 Oct 2013 21:05:13 -0700<br>From: David Mercer <<a href="mailto:radix42@gmail.com">radix42@gmail.com</a>><br>To: Philipp G?hring <<a href="mailto:pg@futureware.at">pg@futureware.at</a>><br>Cc: Alexandre Anzala-Yamajako <<a href="mailto:anzalaya@gmail.com">anzalaya@gmail.com</a>>,<span class="Apple-tab-span" style="white-space: pre;"> </span>Cryptography<br><span class="Apple-tab-span" style="white-space: pre;"> </span><<a href="mailto:cryptography@metzdowd.com">cryptography@metzdowd.com</a>>, John Denker <<a href="mailto:jsd@av8n.com">jsd@av8n.com</a>><br>Subject: Re: [Cryptography] [RNG] on RNGs, VM state, rollback, etc.<br>Message-ID:<br><span class="Apple-tab-span" style="white-space: pre;"> </span><<a href="mailto:CADpjbE3P+-d7K3Uc28U1GROkKtrJ299bVyyu-HPQMSoTPXkQrw@mail.gmail.com">CADpjbE3P+-d7K3Uc28U1GROkKtrJ299bVyyu-HPQMSoTPXkQrw@mail.gmail.com</a>><br>Content-Type: text/plain; charset="utf-8"<br><br>On Sun, Oct 27, 2013 at 3:53 PM, Philipp G?hring <<a href="mailto:pg@futureware.at">pg@futureware.at</a>> wrote:<br><br><blockquote type="cite">Hmm, if someone is able to run secret opcodes, then we already have<br>local code execution, right? And in this case there might be far more<br>powerful secret opcodes that give ring 0, ring -1 , ... access, and we<br>usually have to care about much larger problems than RNG attacks.<br><br></blockquote><br>Uhm, yes, if I as an attacker have "ring -1" level access to your<br>machine/hypervisor/VM/whatever, you are so toast that I have already<br>succeeded, and am not going to give a hoot about attacks on your RNG.<br>I can grab all your keystrokes, private keys when used, unencrypted data,<br>etc.<br><br>I can't think of ANY threat model in which an attacker would continue<br>attacking<br>an RNG if they have that. ANY. Disproof by counter-example from history or<br>the literature appreciated.<br><br>-David Mercer</blockquote><br><div>The beauty of an RNG attack is that it does not require any communications back to the attacker, unlike the other attacks you mention. Such back communications can arouse suspicion. And done right, an RNG attack does not introduce any insecurity in the attacked system that others can exploit. NSA may want to monitor Angela Merkle's traffic without making it easier for Russia or China to do so, for example. </div><div><br></div><div>Arnold Reinhold</div></body></html>