summaryrefslogtreecommitdiff
path: root/WARNING.RNG
diff options
context:
space:
mode:
Diffstat (limited to 'WARNING.RNG')
-rw-r--r--WARNING.RNG95
1 files changed, 0 insertions, 95 deletions
diff --git a/WARNING.RNG b/WARNING.RNG
deleted file mode 100644
index 97da74ff7..000000000
--- a/WARNING.RNG
+++ /dev/null
@@ -1,95 +0,0 @@
1This document contains a description of portable OpenSSH's random
2number collection code. An alternate reading of this text could
3well be titled "Why I should pressure my system vendor to supply
4/dev/random in their OS".
5
6Why is this important? OpenSSH depends on good, unpredictable numbers
7for generating keys, performing digital signatures and forming
8cryptographic challenges. If the random numbers that it uses are
9predictable, then the strength of the whole system is compromised.
10
11A particularly pernicious problem arises with DSA keys (used by the
12ssh2 protocol). Performing a DSA signature (which is required for
13authentication), entails the use of a 160 bit random number. If an
14attacker can predict this number, then they can deduce your *private*
15key and impersonate you or your hosts.
16
17If you are using the builtin random number support (configure will
18tell you if this is the case), then read this document in its entirety.
19Alternately, you can use Lutz Jaenicke's PRNGd - a small daemon which
20collects random numbers and makes them available by a socket.
21
22Please also request that your OS vendor provides a kernel-based random
23number collector (/dev/random) in future versions of your operating
24systems by default.
25
26On to the description...
27
28The portable OpenSSH contains random number collection support for
29systems which lack a kernel entropy pool (/dev/random).
30
31This collector (as of 3.1 and beyond) comes as an external application
32that allows the local admin to decide on how to implement entropy
33collection.
34
35The default entropy collector operates by executing the programs listed
36in ($etcdir)/ssh_prng_cmds, reading their output and adding it to the
37PRNG supplied by OpenSSL (which is hash-based). It also stirs in the
38output of several system calls and timings from the execution of the
39programs that it runs.
40
41The ssh_prng_cmds file also specifies a 'rate' for each program. This
42represents the number of bits of randomness per byte of output from
43the specified program.
44
45The random number code will also read and save a seed file to
46~/.ssh/prng_seed. This contents of this file are added to the random
47number generator at startup. The goal here is to maintain as much
48randomness between sessions as possible.
49
50The default entropy collection code has two main problems:
51
521. It is slow.
53
54Executing each program in the list can take a large amount of time,
55especially on slower machines. Additionally some program can take a
56disproportionate time to execute.
57
58Tuning the random helper can be done by running ./ssh-random-helper in
59very verbose mode ("-vvv") and identifying the commands that are taking
60excessive amounts of time or hanging altogher. Any problem commands can
61be modified or removed from ssh_prng_cmds.
62
63The default entropy collector will timeout programs which take too long
64to execute, the actual timeout used can be adjusted with the
65--with-entropy-timeout configure option. OpenSSH will not try to
66re-execute programs which have not been found, have had a non-zero
67exit status or have timed out more than a couple of times.
68
692. Estimating the real 'rate' of program outputs is non-trivial
70
71The shear volume of the task is problematic: there are currently
72around 50 commands in the ssh_prng_cmds list, portable OpenSSH
73supports at least 12 different OSs. That is already 600 sets of data
74to be analysed, without taking into account the numerous differences
75between versions of each OS.
76
77On top of this, the different commands can produce varying amounts of
78usable data depending on how busy the machine is, how long it has been
79up and various other factors.
80
81To make matters even more complex, some of the commands are reporting
82largely the same data as other commands (eg. the various "ps" calls).
83
84
85How to avoid the default entropy code?
86
87The best way is to read the OpenSSL documentation and recompile OpenSSL
88to use prngd or egd. Some platforms (like earily solaris) have 3rd
89party /dev/random devices that can be also used for this task.
90
91If you are forced to use ssh-rand-helper consider still downloading
92prngd/egd and configure OpenSSH using --with-prngd-port=xx or
93--with-prngd-socket=xx (refer to INSTALL for more information).
94
95$Id: WARNING.RNG,v 1.8 2005/05/26 01:47:54 djm Exp $