[Cryptography] Fwd: [IP] 'We cannot trust' Intel and Via's chip-based crypto, FreeBSD developers say

Tue Dec 10 11:10:06 EST 2013

---------- Forwarded message ----------
From: David Farber <farber at gmail.com>
Date: Tue, Dec 10, 2013 at 9:39 AM
Subject: [IP] 'We cannot trust' Intel and Via's chip-based crypto, FreeBSD
developers say
To: ip <ip at listbox.com>

Begin forwarded message:

From: Dewayne Hendricks <dewayne at warpspeed.com>
Subject: [Dewayne-Net] 'We cannot trust' Intel and Via's chip-based crypto,
FreeBSD developers say
Date: December 10, 2013 at 9:05:32 AM EST
To: Multiple recipients of Dewayne-Net <dewayne-net at warpspeed.com>
Reply-To: dewayne-net at warpspeed.com

“We cannot trust” Intel and Via’s chip-based crypto, FreeBSD developers say
Following NSA leaks from Snowden, engineers lose faith in hardware
randomness.
By Dan Goodin
Dec 10 2013
<
http://arstechnica.com/security/2013/12/we-cannot-trust-intel-and-vias-chip-based-crypto-freebsd-developers-say/
>

Developers of the FreeBSD operating system will no longer allow users to
trust processors manufactured by Intel and Via Technologies as the sole
source of random numbers needed to generate cryptographic keys that can't
easily be cracked by government spies and other adversaries.

The change, which will be effective in the upcoming FreeBSD version 10.0,
comes three months after secret documents leaked by former National
Security Agency (NSA) subcontractor Edward Snowden said the US spy agency
was able to decode vast swaths of the Internet's encrypted traffic. Among
other ways, The New York Times, Pro Publica, and The Guardian reported in
September, the NSA and its British counterpart defeat encryption
technologies by working with chipmakers to insert backdoors, or
cryptographic weaknesses, in their products.

The revelations are having a direct effect on the way FreeBSD will use
hardware-based random number generators to seed the data used to ensure
cryptographic systems can't be easily broken by adversaries. Specifically,
"RDRAND" and "Padlock"—RNGs provided by Intel and Via respectively—will no
longer be the sources FreeBSD uses to directly feed random numbers into the
/dev/random engine used to generate random data in Unix-based operating
systems. Instead, it will be possible to use the pseudo random output of
RDRAND and Padlock to seed /dev/random only after it has passed through a
separate RNG algorithm known as "Yarrow." Yarrow, in turn, will add further
entropy to the data to ensure intentional backdoors, or unpatched
weaknesses, in the hardware generators can't be used by adversaries to
predict their output.

"For 10, we are going to backtrack and remove RDRAND and Padlock backends
and feed them into Yarrow instead of delivering their output directly to
/dev/random," FreeBSD developers said. "It will still be possible to access
hardware random number generators, that is, RDRAND, Padlock etc., directly
by inline assembly or by using OpenSSL from userland, if required, but we
cannot trust them any more."

In separate meeting minutes, developers specifically invoked Snowden's name
when discussing the change.

"Edward Snowdon [sic] -- v. high probability of backdoors in some (HW)
RNGs," the notes read, referring to hardware RNGs. Then, alluding to the
Dual EC_DRBG RNG forged by the National Institute of Standards and
Technology and said to contain an NSA-engineered backdoor, the notes read:
"Including elliptic curve generator included in NIST. rdrand in ivbridge
not implemented by Intel... Cannot trust HW RNGs to provide good entropy
directly. (rdrand implemented in microcode. Intel will add opcode to go
directly to HW.) This means partial revert of some work on rdrand and
padlock."

RNGs are one of the most important ingredients in any secure cryptographic
system. They are akin to the dice shakers used in board games that ensure
the full range of randomness is contained in each roll. If adversaries can
reduce the amount of entropy an RNG produces or devise a way to predict
some of its output, they can frequently devise ways to crack the keys
needed to decrypt an otherwise unreadable message. A weakness in the
/dev/random engine found in Google's Android operating system, for
instance, was the root cause of a critical exploit that recently allowed
thieves to pilfer bitcoins out of a user's digital wallet. RDRAND is the
source of random data provided by Ivy Bridge and later versions of Intel
processors. Padlock seeds random data in chips made by Via.

[snip]

Dewayne-Net RSS Feed: <http://dewaynenet.wordpress.com/feed/>

-------------------------------------------
Archives: https://www.listbox.com/member/archive/247/=now
RSS Feed: https://www.listbox.com/member/archive/rss/247/17139205-98c5b30e
Modify Your Subscription:
https://www.listbox.com/member/?member_id=17139205&id_secret=17139205-4d8a06f8
Unsubscribe Now:
https://www.listbox.com/unsubscribe/?member_id=17139205&id_secret=17139205-97bcd5fc&post_id=20131210093928:DC9E24EE-61A8-11E3-A244-A7D151AF08F6
Powered by Listbox: http://www.listbox.com

-- 

Chuck

======================
Charles L. Jackson

301 656 8716    desk phone
888 469 0805    fax
301 775 1023    mobile

PO Box 221
Port Tobacco, MD 20677
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.metzdowd.com/pipermail/cryptography/attachments/20131210/53f57625/attachment.html>