Recoverable Random Numbers in an Internet of Things Operating System

Abstract

Over the past decade, several security issues with Linux Random Number Generator (LRNG) on PCs and Androids have emerged. The main problem involves the process of entropy harvesting, particularly at boot time. An entropy source in the input pool of LRNG is not transferred into the non-blocking output pool if the entropy counter of the input pool is less than 192 bits out of 4098 bits. Because the entropy estimation of LRNG is highly conservative, the process may require more than one minute for starting the transfer. Furthermore, the design principle of the estimation algorithm is not only heuristic but also unclear. Recently, Google released an Internet of Things (IoT) operating system called Brillo based on the Linux kernel. We analyze the behavior of the random number generator in Brillo, which inherits that of LRNG. In the results, we identify two features that enable recovery of random numbers. With these features, we demonstrate that random numbers of 700 bytes at boot time can be recovered with the success probability of 90% by using time complexity for 5.20 × 2 40 trials. Therefore, the entropy of random numbers of 700 bytes is merely about 43 bits. Since the initial random numbers are supposed to be used for sensitive security parameters, such as stack canary and key derivation, our observation can be applied to practical attacks against cryptosystem.

E-BOOT: Preventing Boot-Time Entropy Starvation in Cloud Systems

“…As we have discussed and analyzed in sections III, IV and V, there are many solutions to generate and collect entropy to be consumed by the final user. Unfortunately, after analyzing all the literature, we found that none of those techniques can be employed to solve the boot-time starvation problem [8]- [11].…”

“…Unfortunately, there are scenarios where this is not always possible. An important example is the boot-entropy starvation problem [8]- [11], which appears when a system (e.g., boot-loader or operating system) requires entropy at boot-time but it is unable to generate or collect enough entropy.…”

Accelerated implementation for testing IID assumption of NIST SP 800-90B using GPU

“…Kim, Han & Lee (2013) presented a technique to recover PreMasterSecret (PMS) of the first SSL session in Android by 2 58 complexity since PMS is generated from insufficient entropy of OpenSSL PRNG at boot-time. Ristenpart & Yilek (2010), Bernstein et al (2013), Michaelis, Meyer & Schwenk (2013), Schneier et al (2015), and Yoo, Kang & Yeom (2017) describe the attacks caused by weakness of entropy collectors or incorrect estimations of the entropy that are exaggerated or too conservative.…”

Implementing a Chaotic Cryptosystem by Performing Parallel Computing on Embedded Systems with Multiprocessors

“…Moreover, technology is constantly evolving with significant advances in the new generation of embedded systems with greater computing power including multi-core processors, for that reason, new threats and vulnerabilities that compromise security information in telecommunications systems are being devised [ 60 ]. Recently, several attacks and cryptanalysis to cryptosystems have been reported in the literature [ 61 , 62 , 63 , 64 , 65 , 66 ], therefore, it is important to continue with the development of new cryptosystems with greater complexity and efficiency, that is, to increase their security, such as key space, entropy, resistance against differential and statistical attacks, among others. Thus, the great technological advances and new emerging technologies have allowed an exponential increase in practical applications for the Internet of Things (IoT), for which it is expected that by the year 2020, more than 50,000 million devices, machines, and systems with digital communication technology through the use of embedded systems will be connected to the Internet [ 67 , 68 , 69 ].…”