0

Some time ago, I remember reading an article on randomization in computing, and how random you can actually get a system to be. The article came about, if I'm not mistaken, because of some seemingly minor change in the code, but resulted in a big security vulnerability.
I can't find the article, and I can't recall what bug it was specifically. Searching the web with nothing but a vague recollection of some bug that was fixed a few years back turns out to be harder than I like it to be. I did however, find this. It seems to fit the description, but only touches on openssl.

I was wondering if, by any chance, this bug was broader than just random numbers in openssl, and actually messed up the entire entropy pool. If this bug has nothing to do with the entropy pool, then: was there ever such a bug (one that caused significant reduction in entropy, and thus predictable randomization)? If so, I'd like to know which distro's were/are vulnerable and where to find the reports of these bugs.
If such a bug doesn't exist... I've had a terrible night (insomnia), which has been known to cause hallucinations and delusions in people... forgive me.

To whom it might concern:
The reason for my asking this is because I'm working on some code, and we've been getting a lot of Higgs-Bugson bug-reports. We've been looking into what could be causing certain issues, and it just has to have something to do with predictable randomization.
I can't go into too much detail, given that I, sadly, am not working for an open-source company, and had to sign an NDA.

  • 3
    Depleted entropy pool or anything like that is an extremely unlikely cause of bugs (other than security ones). If you're coding in C or C++, bad code that produces undefined behavior is 99.9999999% (approx) more likely. – Mat Sep 24 '13 at 8:06
  • Have you tried asking on LKML? I'm sure if anybody remembers, they do. – bahamat Sep 24 '13 at 14:40
3

Software random number generators are not the only source of entropy in the system. Actually they are not sources of entropy at all - software RNGs use external entropy sources to supply entropy to the system. The real source is always a physical one (be it a dedicated hardware RNG, temperature sensors, audio input, timing of network packets, user inputs or even the internal states of the CPU (which for a virtual CPU are not strictly "physical" in some sense) - you name it).

Now as for your question: as Mat mentions in his comment, most of the bugs are due to sloppy design/coding(/testing) - I would go as far as to say it is 100%. My guess is that your code is experiencing some kind of race condition that is handled poorly (if at all). So in a sense it is entropy related (as race condition is a random event). Blaming a RNG for it is a quite bold statement, at least - unless you are using random numbers to trigger it, in which case it looks more like a feature.

By the way, if a broken RNG was the cause of your problems, you would actually see them rather predictably. Regarding the Debian OpenSSL bug - I don't think any other distribution apart from Debian based ones (including Ubuntu) has been hit by it. Yet the bug itself is quite educative from the perspective of how it could have happened in the first place.

  • 1
    +1 for time and effor taken. I know the real source of entropy is (or sources are, rather) physical... I believe the article even mentioned random.org, for example and how they can be used with radiowave antena's and what have you. The race condition was, indeed our first port of call, too... but -and I'm sorry I can't expand on this further, because it pisses me off- some of the software used is closed-source. As far as we know, the bug appeared out of nowhere. We are, currently, running simulations, attempting to reproduce what actually happened. There are other things being explored, too – Elias Van Ootegem Sep 24 '13 at 11:29
  • But I just remembered reading about such a bug, and wanted illiminate it from the list of suspects, rather than confirm it. Now that I read my question again, I see how the misconception of my blaming /dev/random or whatever came about... – Elias Van Ootegem Sep 24 '13 at 11:31
  • I guess the only advice is putting a lots of debug logging and running with that. Either you nail the bug in your code (easier to fix) or in what is not under your control (desperate from the POV of a user, but at least you may feel better as a programmer). – peterph Sep 24 '13 at 12:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.