blob: 44e606d5475bcb9f306b0887dd118c545700d890 [file] [log] [blame]
Damien Miller6f9c3372000-10-25 10:06:04 +11001This document contains a description of portable OpenSSH's random
2number collection code. An alternate reading of this text could
3well be titled "Why I should pressure my system vendor to supply
4/dev/random in their OS".
5
6Why is this important? OpenSSH depends on good, unpredictable numbers
7for generating keys, performing digital signatures and forming
8cryptographic challenges. If the random numbers that it uses are
9predictable, then the strength of the whole system is compromised.
10
11A particularly pernicious problem arises with DSA keys (used by the
12ssh2 protocol). Performing a DSA signature (which is required for
13authentication), entails the use of a 160 bit random number. If an
14attacker can predict this number, then they can deduce your *private*
Damien Millerdf1b6452000-10-25 14:47:35 +110015key and impersonate you or your hosts.
Damien Miller6f9c3372000-10-25 10:06:04 +110016
17If you are using the builtin random number support (configure will
Damien Millerdf1b6452000-10-25 14:47:35 +110018tell you if this is the case), then read this document in its entirety.
Damien Miller0736c4d2001-01-25 10:51:46 +110019Alternately, you can use Lutz Jaenicke's PRNGd - a small daemon which
20collects random numbers and makes them available by a socket.
Damien Miller6f9c3372000-10-25 10:06:04 +110021
22Please also request that your OS vendor provides a kernel-based random
23number collector (/dev/random) in future versions of your operating
Damien Millerdf1b6452000-10-25 14:47:35 +110024systems by default.
Damien Miller6f9c3372000-10-25 10:06:04 +110025
26On to the description...
27
28The portable OpenSSH contains random number collection support for
29systems which lack a kernel entropy pool (/dev/random).
30
31This collector operates by executing the programs listed in
32($etcdir)/ssh_prng_cmds, reading their output and adding it to the
33PRNG supplied by OpenSSL (which is hash-based). It also stirs in the
34output of several system calls and timings from the execution of the
35programs that it runs.
36
37The ssh_prng_cmds file also specifies a 'rate' for each program. This
38represents the number of bits of randomness per byte of output from
39the specified program.
40
41The random number code will also read and save a seed file to
42~/.ssh/prng_seed. This contents of this file are added to the random
Damien Millerdf1b6452000-10-25 14:47:35 +110043number generator at startup. The goal here is to maintain as much
44randomness between sessions as possible.
Damien Miller6f9c3372000-10-25 10:06:04 +110045
Damien Millerdf1b6452000-10-25 14:47:35 +110046The entropy collection code has two main problems:
Damien Miller6f9c3372000-10-25 10:06:04 +110047
481. It is slow.
49
50Executing each program in the list can take a large amount of time,
51especially on slower machines. Additionally some program can take a
52disproportionate time to execute.
53
54This can be tuned by the administrator. To debug the entropy
55collection is great detail, turn on full debugging ("ssh -v -v -v" or
56"sshd -d -d -d"). This will list each program as it is executed, how
57long it took to execute, its exit status and whether and how much data
58it generated. You can the find the culprit programs which are causing
59the real slow-downs.
60
61The entropy collector will timeout programs which take too long
62to execute, the actual timeout used can be adjusted with the
63--with-entropy-timeout configure option. OpenSSH will not try to
64re-execute programs which have not been found, have had a non-zero
65exit status or have timed out more than a couple of times.
66
672. Estimating the real 'rate' of program outputs is non-trivial
68
69The shear volume of the task is problematic: there are currently
70around 50 commands in the ssh_prng_cmds list, portable OpenSSH
71supports at least 12 different OSs. That is already 600 sets of data
72to be analysed, without taking into account the numerous differences
73between versions of each OS.
74
75On top of this, the different commands can produce varying amounts of
76usable data depending on how busy the machine is, how long it has been
77up and various other factors.
78
79To make matters even more complex, some of the commands are reporting
80largely the same data as other commands (eg. the various "ps" calls).
81