<div dir="ltr"><br><br><div class="gmail_quote">---------- Forwarded message ----------<br>From: <b class="gmail_sendername">David Farber</b> <span dir="ltr"><<a href="mailto:farber@gmail.com">farber@gmail.com</a>></span><br>
Date: Tue, Dec 10, 2013 at 9:39 AM<br>Subject: [IP] 'We cannot trust' Intel and Via's chip-based crypto, FreeBSD developers say<br>To: ip <<a href="mailto:ip@listbox.com">ip@listbox.com</a>><br><br><br><br>
<br>
Begin forwarded message:<br>
<br>
From: Dewayne Hendricks <<a href="mailto:dewayne@warpspeed.com">dewayne@warpspeed.com</a>><br>
Subject: [Dewayne-Net] 'We cannot trust' Intel and Via's chip-based crypto, FreeBSD developers say<br>
Date: December 10, 2013 at 9:05:32 AM EST<br>
To: Multiple recipients of Dewayne-Net <<a href="mailto:dewayne-net@warpspeed.com">dewayne-net@warpspeed.com</a>><br>
Reply-To: <a href="mailto:dewayne-net@warpspeed.com">dewayne-net@warpspeed.com</a><br>
<br>
“We cannot trust” Intel and Via’s chip-based crypto, FreeBSD developers say<br>
Following NSA leaks from Snowden, engineers lose faith in hardware randomness.<br>
By Dan Goodin<br>
Dec 10 2013<br>
<<a href="http://arstechnica.com/security/2013/12/we-cannot-trust-intel-and-vias-chip-based-crypto-freebsd-developers-say/" target="_blank">http://arstechnica.com/security/2013/12/we-cannot-trust-intel-and-vias-chip-based-crypto-freebsd-developers-say/</a>><br>
<br>
Developers of the FreeBSD operating system will no longer allow users to trust processors manufactured by Intel and Via Technologies as the sole source of random numbers needed to generate cryptographic keys that can't easily be cracked by government spies and other adversaries.<br>
<br>
The change, which will be effective in the upcoming FreeBSD version 10.0, comes three months after secret documents leaked by former National Security Agency (NSA) subcontractor Edward Snowden said the US spy agency was able to decode vast swaths of the Internet's encrypted traffic. Among other ways, The New York Times, Pro Publica, and The Guardian reported in September, the NSA and its British counterpart defeat encryption technologies by working with chipmakers to insert backdoors, or cryptographic weaknesses, in their products.<br>
<br>
The revelations are having a direct effect on the way FreeBSD will use hardware-based random number generators to seed the data used to ensure cryptographic systems can't be easily broken by adversaries. Specifically, "RDRAND" and "Padlock"—RNGs provided by Intel and Via respectively—will no longer be the sources FreeBSD uses to directly feed random numbers into the /dev/random engine used to generate random data in Unix-based operating systems. Instead, it will be possible to use the pseudo random output of RDRAND and Padlock to seed /dev/random only after it has passed through a separate RNG algorithm known as "Yarrow." Yarrow, in turn, will add further entropy to the data to ensure intentional backdoors, or unpatched weaknesses, in the hardware generators can't be used by adversaries to predict their output.<br>
<br>
"For 10, we are going to backtrack and remove RDRAND and Padlock backends and feed them into Yarrow instead of delivering their output directly to /dev/random," FreeBSD developers said. "It will still be possible to access hardware random number generators, that is, RDRAND, Padlock etc., directly by inline assembly or by using OpenSSL from userland, if required, but we cannot trust them any more."<br>
<br>
In separate meeting minutes, developers specifically invoked Snowden's name when discussing the change.<br>
<br>
"Edward Snowdon [sic] -- v. high probability of backdoors in some (HW) RNGs," the notes read, referring to hardware RNGs. Then, alluding to the Dual EC_DRBG RNG forged by the National Institute of Standards and Technology and said to contain an NSA-engineered backdoor, the notes read: "Including elliptic curve generator included in NIST. rdrand in ivbridge not implemented by Intel... Cannot trust HW RNGs to provide good entropy directly. (rdrand implemented in microcode. Intel will add opcode to go directly to HW.) This means partial revert of some work on rdrand and padlock."<br>
<br>
RNGs are one of the most important ingredients in any secure cryptographic system. They are akin to the dice shakers used in board games that ensure the full range of randomness is contained in each roll. If adversaries can reduce the amount of entropy an RNG produces or devise a way to predict some of its output, they can frequently devise ways to crack the keys needed to decrypt an otherwise unreadable message. A weakness in the /dev/random engine found in Google's Android operating system, for instance, was the root cause of a critical exploit that recently allowed thieves to pilfer bitcoins out of a user's digital wallet. RDRAND is the source of random data provided by Ivy Bridge and later versions of Intel processors. Padlock seeds random data in chips made by Via.<br>
<br>
[snip]<br>
<br>
<br>
<br>
Dewayne-Net RSS Feed: <<a href="http://dewaynenet.wordpress.com/feed/" target="_blank">http://dewaynenet.wordpress.com/feed/</a>><br>
<br>
<br>
<br>
<br>
<br>
-------------------------------------------<br>
Archives: <a href="https://www.listbox.com/member/archive/247/=now" target="_blank">https://www.listbox.com/member/archive/247/=now</a><br>
RSS Feed: <a href="https://www.listbox.com/member/archive/rss/247/17139205-98c5b30e" target="_blank">https://www.listbox.com/member/archive/rss/247/17139205-98c5b30e</a><br>
Modify Your Subscription: <a href="https://www.listbox.com/member/?member_id=17139205&id_secret=17139205-4d8a06f8" target="_blank">https://www.listbox.com/member/?member_id=17139205&id_secret=17139205-4d8a06f8</a><br>
Unsubscribe Now: <a href="https://www.listbox.com/unsubscribe/?member_id=17139205&id_secret=17139205-97bcd5fc&post_id=20131210093928:DC9E24EE-61A8-11E3-A244-A7D151AF08F6" target="_blank">https://www.listbox.com/unsubscribe/?member_id=17139205&id_secret=17139205-97bcd5fc&post_id=20131210093928:DC9E24EE-61A8-11E3-A244-A7D151AF08F6</a><br>
Powered by Listbox: <a href="http://www.listbox.com" target="_blank">http://www.listbox.com</a><br>
</div><br><br clear="all"><div><br></div>-- <br><br>Chuck <br><br>======================<br>Charles L. Jackson<br><br>301 656 8716 desk phone<br>888 469 0805 fax<br>301 775 1023 mobile <br><br>PO Box 221<br>Port Tobacco, MD 20677
</div>