Possible problem with /dev/random

[Robin Carey]

I was reading wikipedia.org recently, where I read
about a problem with Bob Jenkins ISAAC CSPRNG:

In 2006 Jean-Philippe Aumasson discovered several sets
of weak states[3]. The fourth presented (and smallest)
set of weak states leads to a highly biased output for
the first round of ISAAC and allows the derivation of
the internal state, similar to a weakness in RC4. It
is not clear if an attacker can tell from just the
output whether the generator is in one of these weak
states or not. He also shows that a previous attack[4]
is flawed, since the Paul et al. attack is based on an
erroneous algorithm rather than the real ISAAC. An
improved version of ISAAC is proposed, called ISAAC+.

--

I note that DragonFly is not using ISAAC, but is using
IBAA for /dev/random, but I suppose there is a
possibility that the same problem exists in IBAA as
was found in ISAAC.

So I thought I would draw your attention to this -
maybe someone should check to see if the problem
exists. If it does, I would have thought you could
deal with the problem in the same way as RC4;
discarding a certain amount of initial output.

I note that DragonFly uses L15 for /dev/urandom and I
am quite certain that there are no problems there ....

Sincerely,
R Carey.


      __________________________________________________________
Sent from Yahoo! Mail - a smarter inbox http://uk.mail.yahoo.com