blob: 21f4901c98019b6ec5f365346cb6d3aba819b394 [file] [log] [blame]
Damien Miller6f9c3372000-10-25 10:06:04 +11001This document contains a description of portable OpenSSH's random
2number collection code. An alternate reading of this text could
3well be titled "Why I should pressure my system vendor to supply
4/dev/random in their OS".
5
6Why is this important? OpenSSH depends on good, unpredictable numbers
7for generating keys, performing digital signatures and forming
8cryptographic challenges. If the random numbers that it uses are
9predictable, then the strength of the whole system is compromised.
10
11A particularly pernicious problem arises with DSA keys (used by the
12ssh2 protocol). Performing a DSA signature (which is required for
13authentication), entails the use of a 160 bit random number. If an
14attacker can predict this number, then they can deduce your *private*
Damien Millerdf1b6452000-10-25 14:47:35 +110015key and impersonate you or your hosts.
Damien Miller6f9c3372000-10-25 10:06:04 +110016
17If you are using the builtin random number support (configure will
Damien Millerdf1b6452000-10-25 14:47:35 +110018tell you if this is the case), then read this document in its entirety.
Damien Miller6f9c3372000-10-25 10:06:04 +110019
20Please also request that your OS vendor provides a kernel-based random
21number collector (/dev/random) in future versions of your operating
Damien Millerdf1b6452000-10-25 14:47:35 +110022systems by default.
Damien Miller6f9c3372000-10-25 10:06:04 +110023
24On to the description...
25
26The portable OpenSSH contains random number collection support for
27systems which lack a kernel entropy pool (/dev/random).
28
29This collector operates by executing the programs listed in
30($etcdir)/ssh_prng_cmds, reading their output and adding it to the
31PRNG supplied by OpenSSL (which is hash-based). It also stirs in the
32output of several system calls and timings from the execution of the
33programs that it runs.
34
35The ssh_prng_cmds file also specifies a 'rate' for each program. This
36represents the number of bits of randomness per byte of output from
37the specified program.
38
39The random number code will also read and save a seed file to
40~/.ssh/prng_seed. This contents of this file are added to the random
Damien Millerdf1b6452000-10-25 14:47:35 +110041number generator at startup. The goal here is to maintain as much
42randomness between sessions as possible.
Damien Miller6f9c3372000-10-25 10:06:04 +110043
Damien Millerdf1b6452000-10-25 14:47:35 +110044The entropy collection code has two main problems:
Damien Miller6f9c3372000-10-25 10:06:04 +110045
461. It is slow.
47
48Executing each program in the list can take a large amount of time,
49especially on slower machines. Additionally some program can take a
50disproportionate time to execute.
51
52This can be tuned by the administrator. To debug the entropy
53collection is great detail, turn on full debugging ("ssh -v -v -v" or
54"sshd -d -d -d"). This will list each program as it is executed, how
55long it took to execute, its exit status and whether and how much data
56it generated. You can the find the culprit programs which are causing
57the real slow-downs.
58
59The entropy collector will timeout programs which take too long
60to execute, the actual timeout used can be adjusted with the
61--with-entropy-timeout configure option. OpenSSH will not try to
62re-execute programs which have not been found, have had a non-zero
63exit status or have timed out more than a couple of times.
64
652. Estimating the real 'rate' of program outputs is non-trivial
66
67The shear volume of the task is problematic: there are currently
68around 50 commands in the ssh_prng_cmds list, portable OpenSSH
69supports at least 12 different OSs. That is already 600 sets of data
70to be analysed, without taking into account the numerous differences
71between versions of each OS.
72
73On top of this, the different commands can produce varying amounts of
74usable data depending on how busy the machine is, how long it has been
75up and various other factors.
76
77To make matters even more complex, some of the commands are reporting
78largely the same data as other commands (eg. the various "ps" calls).
79