Subject: RE: "Authentication" and "Signature" bits...

From: [email-masked] (Peter Gutmann)
Date: Sat, 11 May 2002 03:31:04 +1200 (NZST)

Hal Lockhart <[email-masked]> writes:

>Commonly cited reasons include ability to generate higher quality random
>numbers and performance issues around time to generate large keys.

I've heard this a couple of times, but each time it was being used as an excuse
for the fact that the CA wanted to do things its own proprietary way and this
was the best justification they could find for it.  In at least two cases the
CA had implemented its own software, incorrectly, and was desperately trying to
avoid having to fix it to interoperate with other vendors' products, leading to
one manager to comment that "It used to be said that patriotism was the last
refuge of the the scoundrel.  Now it's security" :-).

(I'm sure there are CAs who are genuinely concerned about security, but it also
 seems to be a very convenient excuse to ensure that things get done the CAs
 way and no other).

>(You might think the random number issue would be moot by now, but I have yet
>to see a commercial security product of any kind, not just PKI, that uses the
>Pentium III hardware RNG.)

I use it in my code, but given that the user needs to go through a nontrivial
install process to get a special driver set up for it, I think the number of
users it gets is... small.  I've seen it somewhere else as well (OpenSSL?), and
BSAFE uses it too, or at least RSADSI issued a press release saying it did.  In
any case it's not a silver bullet, I go into the requirements for secure random
number generation in some detail in
http://www.cryptoapps.com/~peter/06_random.pdf and I'd rate the PIII hardware
RNG at about the same level as /dev/random, ie one of a number of sources which
you can use as input to a full RNG.

Getting back to scoundrels running CAs, my standard reply to claims about "we
trust our RNG more" is to challenge them to demonstrate how their RNG is more
secure than the one I describe in the paper mentioned above.  I've never had
anyone take me up on that, which only reinforces the feeling that security
isn't the real reason they're doing it.

Peter.

---

From: Dr S N Henson <[email-masked]>
Date: Fri, 10 May 2002 18:12:35 +0100

Peter Gutmann wrote:
> users it gets is... small.  I've seen it somewhere else as well (OpenSSL?), 

Yes, newer versions of OpenSSL will use it on Windows builds if the
aforementioned driver is set up.

Steve.
-- 
Dr Stephen N. Henson.   http://www.drh-consultancy.demon.co.uk/
Personal Email: [email-masked] 
Senior crypto engineer, Gemplus: http://www.gemplus.com/
Core developer of the   OpenSSL project: http://www.openssl.org/
Business Email: [email-masked] PGP key: via homepage.