1 / 51

Random Number Generators for Cryptographic Applications (Part 1)

Random Number Generators for Cryptographic Applications (Part 1). Werner Schindler. Federal Office for Information Security (BSI), Bonn. Bonn, January 17, 2008. Outline (Part 1). Introduction and motivation General requirements on random number generators (RNGs) RNG Classification

lita
Download Presentation

Random Number Generators for Cryptographic Applications (Part 1)

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Random Number Generators for Cryptographic Applications (Part 1) Werner Schindler Federal Office for Information Security (BSI), Bonn Bonn, January 17, 2008

  2. Outline (Part 1) • Introduction and motivation • General requirements on random number generators (RNGs) • RNG Classification • Characteristic properties and differences • Deterministic RNGs • Physical RNGs • Non-physical true RNGs

  3. Random numbers are used ... • as random session keys • to generate RSA prime factors • in DSA, ECDSA (ephemeral keys) • in zero-knowledge-proofs • in challenge-response-protocols • as IV vectors for block ciphers • by TPMs • ...

  4. Protocol information Cryptographic protocols usually demand ... • „generate a random session key“ • „generate a random prime“ • „generate a random 64-bit challenge“ • ... ... but they do not specify the generation process.

  5. What properties should random numbers possess? Usually, no clear requirements are specified. Unexpressed silent requirement: The random numbers should assume all admissible values with equal probability and should be independent from predecessors and successors. This yet characterizes an ideal random number generator.

  6. deterministic non-deterministic (true) pure hybrid physical non-physical pure hybrid pure hybrid Classification (I) RNG

  7. Classification (II) • Deterministic random number generators are also known as pseudorandom number generators. • Hybrid DRNGs and hybrid TRNGs contain design elements from both from deterministic and non-deterministic RNGs. Their security yet essentially is based upon on the deterministic, resp. on the non-deterministic part.

  8. smart card terminal generates random number U M := U || time M C ? C = Enc(M;kC) no yes STOP Example 1: Challenge-response mechanism C := Enc(M;kC)

  9. IV ... AES k k AES || || ... C 1 C 2 Example 2: IV for a block cipher (CBC mode) plaintext T = B1 || B2 || ... The (pseudo-)randomly chosen IV is transmitted in clear.

  10. Alice Bob generates message T generates random session key krnd C :=AES(T;krnd) krndeB(mod nB)|| C computes krnd with dB decrypts C with krnd Example 3: Simplified fragment of a key exchange protocol (dB,eB,nB): Bob‘s RSA key

  11. Requirements (I) Example 1: To prevent replay attacks random numbers U1,U2,... should be mutually distinct with overwhelming probability. (Depending on the full protocol and the application additional requirements may be necessary.) Example 2: The IVs should have similar statistical properties as output values from ideal RNGs (to prevent replay and correlation attacks).

  12. Requirements (II) R1: The random numbers should not show statistical weaknesses. Note: Condition R1 can be checked by statistical tests. Is condition R1 sufficient for Example 3?

  13. Eve Alice Bob Charles Dick krnd,1eB(mod nB) || C1 krnd,2eC(mod nC) || C2 krnd,3eC(mod nC) || C3 krnd,4eD(mod nD) || C4 Example 3 (II)

  14. General Requirements (III) R2: The knowledge of subsequences of random numbers shall not allow to practically compute predecessors or successors or to guess them with non-negligibly larger probability than without knowledge of these subsequences (privileged attacker Charles!).

  15. Observation The minimum requirements on the random numbers depend on the intended application ! Requirement R2 is indispensable for sensitive applications (e.g. for the generation of session keys).

  16. Deterministic Random Number Generators (DRNGs)

  17. s0(seed) sn internal state rn:=f(sn) f sn+1:=h(sn) random number h Pure DRNG (schematic design) h : state transition function f : output function

  18. DRNGs: Advantages • no dedicated hardware required • software implementation • (required e.g. for stream ciphers): identical seeds yield identical random numbers  low costs

  19. DRNGs: Disadvantages • For pure DRNGs the random numbers are completely determined by the seed. •  Output sequences of DRNGs (pseudorandom numbers) cannot be truly independent.They can at most behaveas output sequences of an ideal random number generator with regard to particular aspects. • The internal state has to be protected even if the device is not active.

  20. DRNG: Design Note: In order to meet R2 (unpredictability of predecessors and successors) • the state transition function and / or the output function must be sufficiently complex. • it must be practically infeasible to guess the seed • Hence DRNGs are typically composed of cryptographic primitives (block ciphers, hash functions etc.).

  21. rn (rn,k) (Enc(rn,k), k) Example 1 Enc: block cipher (e.g. AES, Triple-DES) k: key (to be kept secret) internal state: sn = (rn,k) sn+1 = (Enc (rn, k), k) =: (rn+1,k) (typical smart card design)

  22. Example 1: Security evaluation (I) • Requirement R1: • A strong block cipher should not exhibit any statistical weaknesses.Example 1 meets R1 • Requirement R2:Assumption: The attacker knows ri ,ri+1,…,ri+j • Task: Find ri+j+1 = Enc(ri+j,k): • Note that ri+1 = Enc(ri,k), …, ri+j = Enc(ri+j-1,k)  specific chosen-plaintext attack on Enc

  23. Example 1: Security evaluation (II) • Goal: Find ri-1 = Enc-1(ri,k): • Note that ri+j-1 = Enc-1(ri+j,k), …, ri= Enc-1(ri+1,k)  specific chosen-plaintext attack on Enc-1 • If Enc and Enc-1 are secure against chosen-plaintext attacks the DRNG in Example 1 meets Requirement R2. • Example: Enc = AES, Enc = Triple-DES • Counterexample: Enc = DES. • This security proof is typical for DRNGs (= tracing back to recognised properties of well-known cryptographic primitives).

  24. Attack Scenario An attacker learns the current internal state (e.g., by a successful hardware attack on a smart card or because he has access to the PC where the DRNG is implemented).  The attacker can easily compute all following random numbers. What about the preceding random numbers? If this attack scenario is realistic for the intended use of the DRNG it should additionally meet Requirement R3.

  25. Requirements (IV) R3: It shall not be practically feasible to compute preceding random numbers from the internal state or to guess them with non-negligibly larger probability than without knowledge of the internal state. The DRNG from Example 1 does not meet R3 (decryption!) To meet R3 the state transition function h must be one-way (e.g., h = hash function)

  26. Requirements (V) Occasionally, also Requirement R4 is desirable: R4: It shall not be practically feasible to compute future random numbers from the internal state or to guess them with non-negligible larger probability than without knowledge of the internal state.

  27. Remark • Note: Requirement R4 can only be fulfilled by hybrid DRNGs (regular update of the internal state with random data). • R3 and R4 are DRNG-specific requirements. For physical RNGs R3 and R4 (as R1) usually follow “automatically” when R2 is fulfilled.

  28. Remark • L. Dorrendorf, Z. Gutterman, B. Pinkas (2007) and Z. Gutterman, B. Pinkas, T. Reiman (2006)found weaknesses in the random number generators in Windows 2000 and Linux (/dev/urandom function, not /dev/random), respectively. • The source of these attacks was the violation of Requirement R3.

  29. Cryptographically secure DRNGs • Cryptographically secure DRNGs are based upon intractability assumptions (e.g., factoring is hard). On basis of these intractability assumptions certain properties can be proved (e.g., next-bit security). • NOTE: Usually, only asymptotic security properties can be proved (i.e., for a whole family of DRNGs) • Examples: Blum-Blum-Shub-, RSA-, Rabin-pseudorandom bit generator

  30. RSA pseudorandom generator • Setup: Select • distinct primes p,q; n=pq; and 1 < e < (n) • the seed s0 and keep p,q,s0 secret • rn:= sn (mod 2q) with q = 1 (basic version) • sn+1 sne (mod n) • Note: Asymptotically, the exponent q can be enlarged to O(log(log n)).

  31. Blum-Blum Shub DRNG • Setup: Select • distinct primes p, q with p,q  3 (mod 4); n=pq • the seed s0 with gcd (s0, n)=1 and keep these data secret • rn:= sn (mod 2q) with q = 1 (basic version) • sn+1 sn2 (mod n) • Note: Asymptotically, the exponent q can be enlarged to O(log(log n)).

  32. Cryptographically secure DRNGs • Practical Relevance: Cryptographically secure DRNGs play little role in practice due to their low output rate.

  33. Warning Warning Warning • Many pseudorandom number generators and several statistical test suites (Diehard test suite etc.) have been proposed in the literature for stochastic simulations. • This has often confused designers of cryptographic mechanisms who are not familiar with random number generators! • DRNGs which are fully appropriate for stochastic simulations may not even meet Requirement R1.

  34. Physical Random Number Generators (PTRNGs)

  35. external interface digital algorithmic postprocessing buffer (optional) (optional; with or without memory) digitised analog signal (das-random numbers) internal r.n. external r.n. PTRNG (schematic design) analog noise source

  36. Noise source • The noise source is given by dedicated hardware. • The noise source exploits, for example, • noisy diodes • free-running oscillators • radioactive decay • quantum photon effects • ...

  37. Requirements R1 - R4 • Requirement R1 can be checked with statistical tests. • If the internal random numbers are unpredictable the PTRNG will also meet R2. • Apart from exceptional designs R3 and R4 then are automatically fulfilled. • Entropy quantifies the „degree of uncertainty“.

  38. t _ H(X) =  Prob(X= sj)* log2 (Prob(X=sj)) j=1 Entropy (Shannon Entropy) Definition: Let X denote a random variable that assumes values in a finite set S = {s1, ... ,st}. The (Shannon) entropy of X is given by Remark: (i) 0  H(X)  log2| S | (ii) Shannon entropy is (maybe the most) important representative of a family of entropy definitions.

  39. t H(X) = log2 Prob(X= sj) __ j=1 1 1-  Renyi Entropy For 0  the term denotes the Renyi entropy of X to parameter . As a function of  the Rényi entropy is monotonously decreasing. The most important parameters are  = 1 (Shannon entropy) and  =  (or more precisely,   ; min-entropy). H(X) = min {- log2(Prob(X=sj)) | j  t}

  40. Remark (II) • For cryptographic applications the success probability for guessing attacks is a relevant figure. • Shannon entropy may differ significantly from the guess work: • Example: S = {0,1}128, Prob((0,...,0))=2-1 + 2-129,Prob(x)=2-129 for x  (0,...,0);H(X)= 1 + 64.5 = 65.5 • The min entropy is the most conservative entropy measure.

  41. Remark (II) • Usually, the computation of the min entropy is much more costly than the computation of the Shannon entropy. • However, for physical RNGs the Shannon entropy is yet appropriate ( Part 2)

  42. Non-Physical True Random Number Generators (NPTRNGs)

  43. external interface algorithmic postprocessing buffer (optional) (with or without memory) internal r.n. external r.n. NPTRNG (schematic design) entropy source random raw bits

  44. Entropy source (I) • The entropy source is the pendant to the noise source of a PTRNG. • The entropy source typically exploits • user‘s interaction (e.g. key strokes, intermediate times between consecutive key strokes, mouse movement etc.) • system data (time, RAM data, thread number, handle, Windows API functions etc.)

  45. Entropy source (II) Differences to noise sources: • - usually: (entropy / raw bit) is low  requires substantial compression of the raw data ( algorithmic postprocessing) • - usually: the entropy source is not under the control of the RNG designer ( prevents precise entropy estimation) • + no dedicated hardware required

  46. Example 2:Non-physical true RNG The entropy source • interprets key strokes as 6 bit strings to generate 1020 random raw bits numbers • algorithmic postprocessing: • SHA-1(raw data)

  47. Example 3:Non-physical true RNG The entropy source uses • the absolute time • time since system start • thread numbers • handles • RAM content to generate a string of 1024 raw bits. algorithmic postprocessing: • SHA-1(raw data)

  48. Attacks The one-way property of SHA-1 suggests a typical attack on NPTRNGs: • guess the raw bit string • apply the postprocessing algorithm (SHA-1) • check the result (e.g. a session key) • The output of non-physical true RNGs may be used ‘directly’ or to seed / reseed DRNGs.

  49. Evaluation of NPTRNGs: General advice • ignore consecutive strokes of the same key • the effective range of a k-bit API return value may contain considerably less than 2k elements, and the values in the effective range may occur with different probabilities ( entropy defect) • for API functions that return time values consider • the time resolution of the system • the adversary’s knowledge (= preciseness of information) • consider dependencies between data strings (e.g.: absolute time, absolute time at system start, time since system start) • …

  50. Outline (Part 2) • Design and evaluation criteria for physical RNGs • general advice • stochastic model • entropy • online tests, tot test, self test • AIS 31 and ISO 18031 • Conclusion

More Related