Subject: [Dtls-iot] Reference to Heninger Paper

From: Hannes Tschofenig <[email-masked]>
Date: Wed, 15 Jul 2015 13:15:37 +0200

Stephen wrote:

(7) 14: Doesn't [Heninger] really cause many devices to use one RSA
prime factor? That's not the same as "same keys again and again" and in
any case you're not recommending RSA keys on challenged nodes here.
Shouldn't you do the analysis of the impact of a dodgy PRNG on
populations of devices that follow these profiles and not something else?

Heninger did an analysis of the deploy infrastructure of that time and
RSA is in widespread use. Hence, her analysis focuses on the problems
with RSA keys.

However, her observations are general in the sense that a non-existent
or bad random number generator will lead to output that is predictable
or the same with a number of devices. This is essentially what I write.

Copy-and-paste from the text:

---
   Special care has to
   be taken when generating random numbers in embedded systems as many
   entropy sources available on desktop operating systems or mobile
   devices might be missing, as described in [Heninger].  Consequently,
   if not enough time is given during system start time to fill the
   entropy pool then the output might be predictable and repeatable, for
   example leading to the same keys generated again and again.
---

---

From: Stephen Farrell <[email-masked]>
Date: Wed, 15 Jul 2015 12:26:11 +0100

Hiya,

>    example leading to the same keys generated again and again.

It's that last bit that's wrong though. With RSA it was the same first
prime being "found" with non-negligible probability. As far as we know
all the same-key cases are because the private key was installed. And
even with e.g. ECDSA privates of randoms-used-in-signing, if one can
predict some but not all bits, one still wins the game I think.

So s/same keys/weak keys/ would be ok and the reason this is notable
is that I think there are likely developers out there who'd think that
they must be fine if the public key values are unique. [Heninger]
shows us that's not the case.

Even better than s/same keys/weak keys/ would be to explain a bit
more about [Heninger] - say a para like the above.

Cheers,
S.

> ---
> 
> 
> 
> _______________________________________________
> dtls-iot mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dtls-iot
>

---

From: Hannes Tschofenig <[email-masked]>
Date: Tue, 21 Jul 2015 14:41:13 +0200

Hi Stephen,

I discussed the issue with Thomas, my co-author, and we know understand
the misunderstanding. We thought it would be easier to remove the
reference to the Heninger paper.

Here is the new text:

---------------------------------

14.  Random Number Generation

   The TLS/DTLS protocol requires random numbers to be available during
   the protocol run.  For example, during the ClientHello and the
   ServerHello exchange the client and the server exchange random
   numbers.  Also, the use of the Diffie-Hellman exchange requires
   random numbers during the key pair generation.

   It is important to note that sources contributing to the randomness
   pool on laptops, or desktop PCs are not available on many IoT device,
   such as mouse movement, timing of keystrokes, air turbulence on the
   movement of hard drive heads, etc.  Other sources have to be found or
   dedicated hardware has to be added.

   Lacking sources of randomness in an embedded system may lead to the
   same keys generated again and again.

---------------------------------

Ciao
Hannes