From nobody Thu Dec 15 18:15:55 2016 Return-Path: X-Original-To: dsfjdssdfsd@ietfa.amsl.com Delivered-To: dsfjdssdfsd@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DDA561295BD for ; Thu, 15 Dec 2016 18:15:52 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.496 X-Spam-Level: X-Spam-Status: No, score=-5.496 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-2.896, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id C7sfbDb3y8bw for ; Thu, 15 Dec 2016 18:15:50 -0800 (PST) Received: from smtp-p02.blackberry.com (smtp-p02.blackberry.com [208.65.78.89]) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D83BD129C3F for ; Thu, 15 Dec 2016 18:06:31 -0800 (PST) Received: from smtp-pop.rim.net (HELO XCT103CNC.rim.net) ([10.65.161.203]) by mhs214cnc.rim.net with ESMTP/TLS/DHE-RSA-AES256-SHA; 15 Dec 2016 21:06:24 -0500 Received: from XMB116CNC.rim.net ([fe80::45d:f4fe:6277:5d1b]) by XCT103CNC.rim.net ([fe80::b8:d5e:26a5:f4d6%17]) with mapi id 14.03.0319.002; Thu, 15 Dec 2016 21:06:23 -0500 From: Dan Brown To: "dsfjdssdfsd@ietf.org" Thread-Topic: Any readers here? Re: [dsfjdssdfsd] Risks of entropy available Thread-Index: AQHSV0D/nwEO15IEfkyC9WCVoOr4hA== Date: Fri, 16 Dec 2016 02:06:22 +0000 Message-ID: <20161216020620.5705805.17969.8573@blackberry.com> References: <810C31990B57ED40B2062BA10D43FBF501083C12@XMB116CNC.rim.net> In-Reply-To: <810C31990B57ED40B2062BA10D43FBF501083C12@XMB116CNC.rim.net> Accept-Language: en-US, en-CA Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: Content-Type: multipart/related; boundary="_004_201612160206205705805179698573blackberrycom_"; type="multipart/alternative" MIME-Version: 1.0 Archived-At: Subject: [dsfjdssdfsd] Any readers here? Re: Risks of entropy available X-BeenThere: dsfjdssdfsd@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "The dsfjdssdfsd list provides a venue for discussion of randomness in IETF protocols, for example related to updating RFC 4086." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Dec 2016 02:15:53 -0000 --_004_201612160206205705805179698573blackberrycom_ Content-Type: multipart/alternative; boundary="_000_201612160206205705805179698573blackberrycom_" --_000_201612160206205705805179698573blackberrycom_ Content-Type: text/plain; charset="windows-1256" MIME-Version: 1.0 Content-Transfer-Encoding: base64 SXMgYW55Ym9keSBzdGlsbCByZWFkaW5nIHRoaXMgbGlzdD8KCk5vdCBzdXJlIGlmIG15IHByZXZp b3VzIHBvc3QgYmVsb3cgd2FzIGNsZWFyIGVub3VnaCwg/WJ1dCBpZiBpdCB3YXMgY2xlYXIgYW5k IGlmIGl0IHdhcyByZWFkLCB0aGVuIG1heWJlIGl0J3MganVzdCBub3QgY29uY2VybmluZyBlbm91 Z2ggdG8ganVzdGlmeSBhIHJlcGx5PwoKU2VudCBmcm9tIG15IEJsYWNrQmVycnkgMTAgc21hcnRw aG9uZSBvbiB0aGUgUm9nZXJzIG5ldHdvcmsuCkZyb206IERhbiBCcm93bgpTZW50OiBNb25kYXks IE5vdmVtYmVyIDI4LCAyMDE2IDExOjUxIEFNClRvOiBkc2ZqZHNzZGZzZEBpZXRmLm9yZwpTdWJq ZWN0OiBbZHNmamRzc2Rmc2RdIFJpc2tzIG9mIGVudHJvcHkgYXZhaWxhYmxlCgoKU29tZSBSTkdz IChpbmNsdWRpbmcgc29tZSB2ZXJzaW9ucyBvZiBMaW51eCAvZGV2L3JhbmRvbSkgaGF2ZSBhbiBp bnRlcmZhY2UgdGhhdCBleHBvc2VzIHRoZSBlc3RpbWF0ZWQgYW1vdW50IG9mIGVudHJvcHkgaW4g dGhlIHNlY3JldCBzdGF0ZSBvZiB0aGUgUk5HLgoKSWYgYW4gYWR2ZXJzYXJ5IGdhaW5zIGFjY2Vz cyB0byB0aGlzIGludGVyZmFjZSwgdGhlbiB0aGVyZSBpcyBhIHNtYWxsIHJpc2sgdGhhdCBzZW5z aXRpdmUgaW5mb3JtYXRpb24gbGVha3MgdG8gdGhlIGFkdmVyc2FyeSwgYmVjYXVzZSB0aGUgZW50 cm9weSBlc3RpbWF0ZSBtYXkgYmUgZGVyaXZlZCBmcm9tIGFuZCBjb3JyZWxhdGVkIHRvIHNlbnNp dGl2ZSBpbmZvcm1hdGlvbi4KCkp1c3QgdG8gYmUgY2xlYXIsIEkgZG8gbm90IHNlZSB0aGlzIHRv IGJlIGEgc2VyaW91cyByaXNrLiAgSXQgd291bGQgYmUgZGlmZmljdWx0IHRvIGV4cGxvaXQuICBZ ZXQgSSBkbyBub3Qgc2VlIGVub3VnaCBiZW5lZml0IGluIHRoaXMgaW50ZXJmYWNlIHRvIHN1cHBv cnQgdGFraW5nIHRoaXMgcmlzay4KClRoaXMgaXNzdWUgaGFzIHByb2JhYmx5IGJlZW4gZGlzY3Vz c2VkIGVsc2V3aGVyZSwgbWF5YmUgd2l0aCBkaWZmZXJlbnQgY29uY2x1c2lvbnMgZnJvbSwgYW5k IGJldHRlciByZWFzb25pbmcgdGhhbiwgbWluZS4gIElmIHNvLCB0aGVuIGEgcmVwbHkgY291bGQg anVzdCBwb2ludCB0byB0aG9zZSBkaXNjdXNzaW9ucy4KCi0tLQoKTW9yZSBkZXRhaWwgc2tldGNo ZWQgb3V0IGJlbG93OgoKVGhlIGVudHJvcHkgaW4gdGhlIFJORyBtdXN0IG5lY2Vzc2FyaWx5IGJl IGRlcml2ZWQgZnJvbSBzZWNyZXQgc291cmNlcy4gIEluIG1hbnkgc3lzdGVtcywgdGhlIHNlY3Jl dCBzb3VyY2VzIGluY2x1ZGUgdGhpbmdzIGxpa2Uga2V5Ym9hcmQgaW5wdXQgdGltaW5ncywgd2hp Y2ggY2FuIGJlIGZ1cnRoZXIgY2xhc3NpZmllZCBhcyBzZW5zaXRpdmUgc291cmNlcy4gIFRoZSBl c3RpbWF0ZWQgZW50cm9weSBpcyBhbHNvIGRlcml2ZWQgaW4gc29tZSB3YXkgZnJvbSB0aGVzZSBz ZWNyZXQgc2Vuc2l0aXZlIHNvdXJjZXMuICBUaGlzIGRlcml2YXRpb24gb2YgdGhlIGVzdGltYXRl ZCBlbnRyb3B5IGlzIG5vdCBnZW5lcmFsbHkgYSBjcnlwdG9ncmFwaGljYWxseSBzdHJvbmcgb25l LXdheSBmdW5jdGlvbi4gIEZ1cnRoZXJtb3JlLCB0aGUgdGltaW5nIGluZm9ybWF0aW9uIG1pZ2h0 IGJlIGxlYWtlZCBldmVuIGlmIGVzdGltYXRpb24gaXMgc29tZWhvdyBvbmUtd2F5LiAgVGhlcmVm b3JlLCB0aGUgaW50ZXJmYWNlcyBsZWFrcyBpbmZvcm1hdGlvbiBhYm91dCB0aGUgc2Vuc2l0aXZl IHNvdXJjZXMuCgpGb3IgYSBjb25jcmV0ZSBleGFtcGxlLCB0aGUgaW50ZXJmYWNlIG1pZ2h0IGxl YWsgaW5mb3JtYXRpb24gYWJvdXQgdGhlIGtleWJvYXJkIHRpbWluZ3MsIHdoaWNoIG1pZ2h0IGlu IHR1cm4gbGVhayBpbmZvcm1hdGlvbiBhYm91dCB0aGUgdmFsdWVzIG9mIHRoZSBrZXkgaW5wdXRz IChpZiwgc2F5LCB0aGVyZSBpcyBhIGNvcnJlbGF0aW9uIGJldHdlZW4gdGhlIHZhbHVlcyBhbmQg dGltaW5ncywgd2hpY2ggbWlnaHQgYmUgdGhlIGNhc2UsIGlmIHNheSB0aGUgZGlmZmVyZW5jZSBr ZXktZG93biBhbmQga2V5LXVwIHRpbWVzIHZhcnkgc2lnbmlmaWNhbnRseSBiZXR3ZWVuIGRpZmZl cmVudCBrZXlib2FyZCBpbnB1dHMpLgoKSSBkb26SdCBzZWUgbXVjaCB2YWx1ZSBvZiBwcm92aWRp bmcgdGhpcyBlc3RpbWF0ZWQtZW50cm9weSBpbnRlcmZhY2UgYXQgYWxsLiAgQXJndWFibHksIHN5 c3RlbSBhZG1pbmlzdHJhdG9ycyBtaWdodCBmaW5kIGl0IHVzZWZ1bCB0byBrbm93IHdoZXRoZXIg dGhlIHN5c3RlbSBpcyBpbiBhIHNlY3VyZSBzdGF0ZSAocGVyaGFwcyB0byBkaWFnbm9zZSBzb21l IGtpbmQgb2YgcHJvYmxlbSkuIE9idmlvdXNseSwgdGhpcyBpbnRlcmZhY2UgZG9lcyBub3QgZXNj YWxhdGUgYSBzeXN0ZW0gYWRtaW5pc3RyYXRvcpJzIGFscmVhZHkgaGlnaCBwcml2aWxlZ2VzLiAg QnV0IHByb3ZpZGluZyB0aGlzIGludGVyZmFjZSB0byBub24tcHJpdmlsZWdlZCBwcm9jZXNzZXMg cmlza3MgZXhwb3N1cmUgb2Ygc2Vuc2l0aXZlIGluZm9ybWF0aW9uIHRvIHVuYXV0aG9yaXplZCBw cm9jZXNzZXMuCgpBIHNpbXBsZSB3YXkgdG8gcmVkdWNlIHRoaXMgcmlzayB3b3VsZCBiZSB0byBk ZW55IGFjY2VzcyB0byBub24tcHJpdmlsZWdlZCB1c2VycywgZGlzYWxsb3dpbmcgdGhlbSB0byBz ZWUgdGhlIHJ1bi10aW1lIGVudHJvcHkgZXN0aW1hdGUuCgpBIG1vcmUgc2V2ZXJlIHJlY29tbWVu ZGF0aW9uIChCYXJhayBhbmQgSGFsZXZpLCBodHRwOi8vaWEuY3IvMjAwNS8wMjkpIGlzIHRvIG5v dCBrZWVwIGEgcnVuLXRpbWUgZXN0aW1hdGUgb2YgZW50cm9weS4KCkJ1dCBzb21lIHNlY3VyaXR5 IGdvYWxzIGRvIG5lZWQgbGl2ZSBlbnRyb3B5LCB3aGljaCBtaWdodCBzdWdnZXN0IHVzaW5nIHNv bWUgbGltaXRlZCBydW4tdGltZSBlbnRyb3B5IGVzdGltYXRpb24uICBGb3IgZXhhbXBsZSwgTklT VCBTUCA4MDAtOTAqIHN0YW5kYXJkcyBoYXZlIGEgbm90aW9uIG9mIHByZWRpY3Rpb24gcmVzaXN0 YW5jZSAod2hpY2ggaXMgc2ltaWxhciBvZiBMaW51eCAvZGV2L3JhbmRvbZJzIGJsb2NraW5nIGlu dGVyZmFjZSkuICAgSW4gdGhpcyBtb2RlLCB0aGUgUk5HIHdhaXRzIHVudGlsIGl0IGRlZW1zIGl0 IGhhcyBlbm91Z2gsIHByZXN1bWFibHkgZnJlc2ggZW50cm9weS4gIFRoZSBvc3RlbnNpYmxlIHB1 cnBvc2UgaXMgdG8gcmVjb3ZlciBmcm9tIHBhc3QgdGVtcG9yYXJ5IHN0YXRlLWV4cG9zdXJlcy4g IFRoZSBOSVNUIGFwcHJvYWNoIGlzIGdhdGhlciB0byBmcmVzaCBlbnRyb3B5IGZyb20gYSBsaXZl IG5vaXNlIHNvdXJjZS4gIElmIHRoaXMgbm9pc2Ugc291cmNlIGhhcyBpdHMgZW50cm9weSBhc3Nl c3NlZCBvbmx5IGF0IGRlc2lnbiB0aW1lLCBub3QgYXQgcnVuLXRpbWUsIHRoZW4gQmFyYWsgYW5k IEhhbGV2aZJzIHJlY29tbWVuZGF0aW9uIChvZiBubyBydW4tdGltZSBlbnRyb3B5IGVzdGltYXRp b24pLCBjYW4gYmUgZm9sbG93ZWQuIFRoZSBOSVNUIHN0YW5kYXJkcyBtaWdodCwgaG93ZXZlciwg aGF2ZSBzb21lIG1pbGQgaGVhbHRoIHRlc3QgY2hlY2tzIG9mIGVudHJvcHkgc291cmNlLCB3aGlj aCBvbmx5IGFpbSB0byBkZXRlY3Qgc2V2ZXJlIGZhaWx1cmUsIG1ha2luZyB0aGVtIG9ubHkgbWls ZGx5IGluY29tcGF0aWJsZSB3aXRoIHRoZSBCYXJhay1IYWxldmkgYXBwcm9hY2guCgpJZiBJIHVu ZGVyc3RhbmQgY29ycmVjdGx5LCB0aGUgcmVjZW50IC9kZXYvcmFuZG9tIGFwcHJvYWNoZXMgYXJl IHRvIGRlY3JlYXNlIHRoZSBlc3RpbWF0ZSBlbnRyb3B5IG9uIGFuIG9uZ29pbmcgYmFzaXMgKHN1 Y2ggYXMgZHVyaW5nIGNhbGxzIC9kZXYvcmFuZG9tKSwgdG8gZW5zdXJlIHRoZSBjdXJyZW50IHBv b2wgaXMgZGVlbWVkIHRvIGJlIGZyZXNoIGVudHJvcHkuICAgVGhlIGZyZXNobmVzcyBzbyBvYnRh aW5lZCBtaWdodCBoYXZlIGEgcHVycG9zZSBzaW1pbGFyIHRvIE5JU1SScyBzZWN1cml0eSBnb2Fs IG9mIHByZWRpY3Rpb24gcmVzaXN0YW5jZSAocmVjb3ZlcnkgZnJvbSB0ZW1wb3Jhcnkgc3RhdGUt Y29tcHJvbWlzZSkuICBVbmZvcnR1bmF0ZWx5LCB0aGlzIHN0ZXAgb2YgZGVjcmVhc2luZyB0aGUg ZW50cm9weSBlc3RpbWF0ZSBpbmNyZWFzZXMgdGhlIHJpc2sgb2YgdGhlIGludGVyZmFjZS4gICBG b3IgZXhhbXBsZSwgaWYgdGhlIGVudHJvcHkgaXMgaW4gYSBuZWFyIGZ1bGwgc3RhdGUsIHRoZW4g L2Rldi9yYW5kb20gbWlnaHQgY2Vhc2UgdG8gaW5jcmVhc2UgaXRzIGVudHJvcHkgZXN0aW1hdGUu ICBJbiB0aGlzIGZ1bGwgc3RhdGUsIHRoZSBsZWFrIGlzIHJlZHVjZWQgb3Igc3RvcHBlZCwgYmVj YXVzZSB0aGUgZW50cm9weSBlc3RpbWF0ZSBkb2VzIG5vdCBjaGFuZ2UgYXMgb2Z0ZW4uICBUbyBj aXJjdW12ZW50IHRoaXMgb2JzdGFjbGUsIHRoZSBhZHZlcnNhcnkgY2FuIGRyYXcgZG93biB0aGUg ZW50cm9weSBlc3RpbWF0ZSBieSBjYWxsaW5nIC9kZXYvcmFuZG9tLCB0aGVyZWJ5IGNhdXNlIHRo ZSBSTkcgdG8gZGVjcmVhc2UgaXRzIGVudHJvcHkgZXN0aW1hdGUuICBJbiBzbyBkb2luZywgdGhl IGFkdmVyc2FyeSBjYW4gY2hhbmdlIHRoZSBSTkcgc3RhdGUgZnJvbSBub24tbGVha3kgYmFjayB0 byBsZWFreS4gIChUaGUgaXNzdWUgb2YgY2FsbHMgdG8gL2Rldi9yYW5kb20gYmVpbmcgYWJ1c2Vk IGZvciBhbm90aGVyIHB1cnBvc2UgdG8gY2F1c2UgYSBkZW5pYWwgb2Ygc2VydmljZSBoYXMgYWxy ZWFkeSBiZWVuIGxhcmdlbHkgbWl0aWdhdGVkIGJ5IGNoYW5nZXMgaW4gdGhlIC9kZXYvcmFuZG9t IHN5c3RlbS4pCgpUaGUgZW50cm9weSBlc3RpbWF0ZSBpbnRlcmZhY2UgZXhwb3NlcyBtb3JlIGlu Zm9ybWF0aW9uIHRoYW4gdGhlIGJsb2NraW5nIGJlaGF2aW9yIG9mIHNvbWV0aGluZyBsaWtlIC9k ZXYvcmFuZG9tLCBpbiB0aGF0IHRoZSBlbnRyb3B5IGVzdGltYXRlIG51bWJlcnMgY29udGFpbiBt b3JlIGluZm9ybWF0aW9uIHRoYW4gdGhlIHNpbmdsZSBiaXQgb2YgYmxvY2tlZC9ub24tYmxvY2tl ZCBzdGF0ZSwgYW5kIGZ1cnRoZXIgdGhlIGVudHJvcHkgZXN0aW1hdGUgY2hhbmdlcyBtb3JlIGZy ZXF1ZW50bHkgdGhhbiB0aGUgYmxvY2tpbmcgc3RhdGUuICBCdXQgZXZlbiB0aGUgYmxvY2tpbmcg YmVoYXZpb3Igb2YgL2Rldi9yYW5kb20gaGFzIHRoZSBwb3RlbnRpYWwgdG8gbGVhayBhIG1pbmlz Y3VsZSBpbmZvcm1hdGlvbiwgc3VjaCBhcyB0aGUgdGltaW5nIGluZm9ybWF0aW9uLiAgRm9yIGV4 YW1wbGUsIGEgbWFsaWNpb3VzIG5vbi1wcml2aWxlZ2VkIHByb2Nlc3MgbWlnaHQgY2FsbCAvZGV2 L3JhbmRvbSB2ZXJ5IGZyZXF1ZW50bHkgdW50aWwgaXQgYmxvY2tzLiAgV2hldGhlciBhbm90aGVy IHVzZXIsIHNheSB0aGUgc3lzdGVtIGFkbWluaXN0cmF0b3IsIG9uIHRoZSBzeXN0ZW0gdHlwZXMg c2Vuc2l0aXZlIGtleWJvYXJkIGlucHV0IGludG8gYW5vdGhlciBwcm9jZXNzLCAvZGV2L3JhbmRv bSBtYXkgdW5ibG9jay4gIFRoZSBtYWxpY2lvdXMgcHJvY2VzcyBjYW4gdGhlbiBnYXRoZXIgc29t ZSB0aW1pbmcgaW5mb3JtYXRpb24gYWJvdXQgdGhlIGtleWJvYXJkIGlucHV0cy4gIEkgc2VlIHRo aXMgYXMgYSBtdWNoIHNtYWxsZXIgcmlzaywgd2hpY2ggaXMgYXJndWFibHkgd29ydGggdGhlIGJl bmVmaXQgb2YgdGhlIHByZWRpY3Rpb24gcmVzaXN0YW5jZSBwcm9wZXJ0aWVzIG9mIC9kZXYvcmFu ZG9tLiAgQWdhaW4sIHRoZSByZWFzb24gaXQgaXMgc21hbGxlciByaXNrIGlzIHRoYXQgYmxvY2tp bmcgc3RhdGUgY2hhbmdlcyBtdWNoIGxlc3MgZnJlcXVlbnRseSB0aGFuIHRoZSBlbnRyb3B5IGVz dGltYXRlLiAgTW9uaXRvcmluZyBjaGFuZ2VzIGluIHRoZSBlbnRyb3B5IGVzdGltYXRlIGNhbiB0 aGVyZWZvcmUgbXVjaCBtb3JlIHByZWNpc2UgdGltaW5nIGluZm9ybWF0aW9uLgoKQmVzdCByZWdh cmRzLAoKRGFuIEJyb3duCgpbQmxhY2tCZXJyeV08aHR0cDovL3d3dy5ibGFja2JlcnJ5LmNvbS8+ CgotLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0KVGhpcyB0cmFuc21pc3Npb24gKGluY2x1ZGluZyBhbnkgYXR0YWNobWVu dHMpIG1heSBjb250YWluIGNvbmZpZGVudGlhbCBpbmZvcm1hdGlvbiwgcHJpdmlsZWdlZCBtYXRl cmlhbCAoaW5jbHVkaW5nIG1hdGVyaWFsIHByb3RlY3RlZCBieSB0aGUgc29saWNpdG9yLWNsaWVu dCBvciBvdGhlciBhcHBsaWNhYmxlIHByaXZpbGVnZXMpLCBvciBjb25zdGl0dXRlIG5vbi1wdWJs aWMgaW5mb3JtYXRpb24uIEFueSB1c2Ugb2YgdGhpcyBpbmZvcm1hdGlvbiBieSBhbnlvbmUgb3Ro ZXIgdGhhbiB0aGUgaW50ZW5kZWQgcmVjaXBpZW50IGlzIHByb2hpYml0ZWQuIElmIHlvdSBoYXZl IHJlY2VpdmVkIHRoaXMgdHJhbnNtaXNzaW9uIGluIGVycm9yLCBwbGVhc2UgaW1tZWRpYXRlbHkg cmVwbHkgdG8gdGhlIHNlbmRlciBhbmQgZGVsZXRlIHRoaXMgaW5mb3JtYXRpb24gZnJvbSB5b3Vy IHN5c3RlbS4gVXNlLCBkaXNzZW1pbmF0aW9uLCBkaXN0cmlidXRpb24sIG9yIHJlcHJvZHVjdGlv biBvZiB0aGlzIHRyYW5zbWlzc2lvbiBieSB1bmludGVuZGVkIHJlY2lwaWVudHMgaXMgbm90IGF1 dGhvcml6ZWQgYW5kIG1heSBiZSB1bmxhd2Z1bC4KLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tClRoaXMgdHJhbnNtaXNz aW9uIChpbmNsdWRpbmcgYW55IGF0dGFjaG1lbnRzKSBtYXkgY29udGFpbiBjb25maWRlbnRpYWwg aW5mb3JtYXRpb24sIHByaXZpbGVnZWQgbWF0ZXJpYWwgKGluY2x1ZGluZyBtYXRlcmlhbCBwcm90 ZWN0ZWQgYnkgdGhlIHNvbGljaXRvci1jbGllbnQgb3Igb3RoZXIgYXBwbGljYWJsZSBwcml2aWxl Z2VzKSwgb3IgY29uc3RpdHV0ZSBub24tcHVibGljIGluZm9ybWF0aW9uLiBBbnkgdXNlIG9mIHRo aXMgaW5mb3JtYXRpb24gYnkgYW55b25lIG90aGVyIHRoYW4gdGhlIGludGVuZGVkIHJlY2lwaWVu dCBpcyBwcm9oaWJpdGVkLiBJZiB5b3UgaGF2ZSByZWNlaXZlZCB0aGlzIHRyYW5zbWlzc2lvbiBp biBlcnJvciwgcGxlYXNlIGltbWVkaWF0ZWx5IHJlcGx5IHRvIHRoZSBzZW5kZXIgYW5kIGRlbGV0 ZSB0aGlzIGluZm9ybWF0aW9uIGZyb20geW91ciBzeXN0ZW0uIFVzZSwgZGlzc2VtaW5hdGlvbiwg ZGlzdHJpYnV0aW9uLCBvciByZXByb2R1Y3Rpb24gb2YgdGhpcyB0cmFuc21pc3Npb24gYnkgdW5p bnRlbmRlZCByZWNpcGllbnRzIGlzIG5vdCBhdXRob3JpemVkIGFuZCBtYXkgYmUgdW5sYXdmdWwu Cg== --_000_201612160206205705805179698573blackberrycom_ Content-Type: text/html; charset="windows-1256" MIME-Version: 1.0 Content-Transfer-Encoding: base64 PGh0bWw+CjxoZWFkPgo8bWV0YSBodHRwLWVxdWl2PSJDb250ZW50LVR5cGUiIGNvbnRlbnQ9InRl eHQvaHRtbDsgY2hhcnNldD13aW5kb3dzLTEyNTYiPgo8c3R5bGU+CjwhLS0KQGZvbnQtZmFjZQoJ e2ZvbnQtZmFtaWx5OiJDYW1icmlhIE1hdGgifQpAZm9udC1mYWNlCgl7Zm9udC1mYW1pbHk6Q2Fs aWJyaX0KcC5Nc29Ob3JtYWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbAoJe21hcmdpbjow aW47CgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7Cglmb250LXNpemU6MTEuMHB0OwoJZm9udC1mYW1p bHk6IkNhbGlicmkiLHNhbnMtc2VyaWZ9CmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsKCXtjb2xv cjojMDU2M0MxOwoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZX0KYTp2aXNpdGVkLCBzcGFuLk1z b0h5cGVybGlua0ZvbGxvd2VkCgl7Y29sb3I6Izk1NEY3MjsKCXRleHQtZGVjb3JhdGlvbjp1bmRl cmxpbmV9CnNwYW4uRW1haWxTdHlsZTE3Cgl7Zm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2Vy aWY7Cgljb2xvcjp3aW5kb3d0ZXh0fQouTXNvQ2hwRGVmYXVsdAoJe2ZvbnQtZmFtaWx5OiJDYWxp YnJpIixzYW5zLXNlcmlmfQpAcGFnZSBXb3JkU2VjdGlvbjEKCXttYXJnaW46MS4waW4gMS4waW4g MS4waW4gMS4waW59CmRpdi5Xb3JkU2VjdGlvbjEKCXt9Ci0tPgo8L3N0eWxlPgo8L2hlYWQ+Cjxi b2R5IGxhbmc9IkVOLVVTIiBsaW5rPSIjMDU2M0MxIiB2bGluaz0iIzk1NEY3MiI+CjxkaXYgc3R5 bGU9IndpZHRoOjEwMCU7IGZvbnQtc2l6ZTppbml0aWFsOyBmb250LWZhbWlseTpDYWxpYnJpLCdT bGF0ZSBQcm8nLHNhbnMtc2VyaWYsc2Fucy1zZXJpZjsgY29sb3I6cmdiKDMxLDczLDEyNSk7IHRl eHQtYWxpZ246aW5pdGlhbDsgYmFja2dyb3VuZC1jb2xvcjpyZ2IoMjU1LDI1NSwyNTUpIj4KSXMg YW55Ym9keSBzdGlsbCByZWFkaW5nIHRoaXMgbGlzdD88L2Rpdj4KPGRpdiBzdHlsZT0id2lkdGg6 MTAwJTsgZm9udC1zaXplOmluaXRpYWw7IGZvbnQtZmFtaWx5OkNhbGlicmksJ1NsYXRlIFBybycs c2Fucy1zZXJpZixzYW5zLXNlcmlmOyBjb2xvcjpyZ2IoMzEsNzMsMTI1KTsgdGV4dC1hbGlnbjpp bml0aWFsOyBiYWNrZ3JvdW5kLWNvbG9yOnJnYigyNTUsMjU1LDI1NSkiPgo8YnI+CjwvZGl2Pgo8 ZGl2IHN0eWxlPSJ3aWR0aDoxMDAlOyBmb250LXNpemU6aW5pdGlhbDsgZm9udC1mYW1pbHk6Q2Fs aWJyaSwnU2xhdGUgUHJvJyxzYW5zLXNlcmlmLHNhbnMtc2VyaWY7IGNvbG9yOnJnYigzMSw3Mywx MjUpOyB0ZXh0LWFsaWduOmluaXRpYWw7IGJhY2tncm91bmQtY29sb3I6cmdiKDI1NSwyNTUsMjU1 KSI+Ck5vdCBzdXJlIGlmIG15IHByZXZpb3VzIHBvc3QgYmVsb3cgd2FzIGNsZWFyIGVub3VnaCwg /WJ1dCBpZiBpdCB3YXMgY2xlYXIgYW5kIGlmIGl0IHdhcyByZWFkLCB0aGVuIG1heWJlIGl0J3Mg anVzdCBub3QgY29uY2VybmluZyBlbm91Z2ggdG8ganVzdGlmeSBhIHJlcGx5PzwvZGl2Pgo8ZGl2 IHN0eWxlPSJ3aWR0aDoxMDAlOyBmb250LXNpemU6aW5pdGlhbDsgZm9udC1mYW1pbHk6Q2FsaWJy aSwnU2xhdGUgUHJvJyxzYW5zLXNlcmlmLHNhbnMtc2VyaWY7IGNvbG9yOnJnYigzMSw3MywxMjUp OyB0ZXh0LWFsaWduOmluaXRpYWw7IGJhY2tncm91bmQtY29sb3I6cmdiKDI1NSwyNTUsMjU1KSI+ CjxiciBzdHlsZT0iZGlzcGxheTppbml0aWFsIj4KPC9kaXY+CjxkaXYgc3R5bGU9ImZvbnQtc2l6 ZTppbml0aWFsOyBmb250LWZhbWlseTpDYWxpYnJpLCdTbGF0ZSBQcm8nLHNhbnMtc2VyaWYsc2Fu cy1zZXJpZjsgY29sb3I6cmdiKDMxLDczLDEyNSk7IHRleHQtYWxpZ246aW5pdGlhbDsgYmFja2dy b3VuZC1jb2xvcjpyZ2IoMjU1LDI1NSwyNTUpIj4KU2VudCZuYnNwO2Zyb20mbmJzcDtteSZuYnNw O0JsYWNrQmVycnkmbmJzcDsxMCZuYnNwO3NtYXJ0cGhvbmUmbmJzcDtvbiZuYnNwO3RoZSZuYnNw O1JvZ2VycyZuYnNwO25ldHdvcmsuPC9kaXY+Cjx0YWJsZSB3aWR0aD0iMTAwJSIgc3R5bGU9ImJh Y2tncm91bmQtY29sb3I6d2hpdGU7IGJvcmRlci1zcGFjaW5nOjBweCI+Cjx0Ym9keT4KPHRyPgo8 dGQgY29sc3Bhbj0iMiIgc3R5bGU9ImZvbnQtc2l6ZTppbml0aWFsOyB0ZXh0LWFsaWduOmluaXRp YWw7IGJhY2tncm91bmQtY29sb3I6cmdiKDI1NSwyNTUsMjU1KSI+CjxkaXYgc3R5bGU9ImJvcmRl ci1zdHlsZTpzb2xpZCBub25lIG5vbmU7IGJvcmRlci10b3AtY29sb3I6cmdiKDE4MSwxOTYsMjIz KTsgYm9yZGVyLXRvcC13aWR0aDoxcHQ7IHBhZGRpbmc6M3B0IDBpbiAwaW47IGZvbnQtZmFtaWx5 OlRhaG9tYSwnQkIgQWxwaGEgU2FucycsJ1NsYXRlIFBybyc7IGZvbnQtc2l6ZToxMHB0Ij4KPGRp dj48Yj5Gcm9tOiA8L2I+RGFuIEJyb3duPC9kaXY+CjxkaXY+PGI+U2VudDogPC9iPk1vbmRheSwg Tm92ZW1iZXIgMjgsIDIwMTYgMTE6NTEgQU08L2Rpdj4KPGRpdj48Yj5UbzogPC9iPmRzZmpkc3Nk ZnNkQGlldGYub3JnPC9kaXY+CjxkaXY+PGI+U3ViamVjdDogPC9iPltkc2ZqZHNzZGZzZF0gUmlz a3Mgb2YgZW50cm9weSBhdmFpbGFibGU8L2Rpdj4KPC9kaXY+CjwvdGQ+CjwvdHI+CjwvdGJvZHk+ CjwvdGFibGU+CjxkaXYgc3R5bGU9ImJvcmRlci1zdHlsZTpzb2xpZCBub25lIG5vbmU7IGJvcmRl ci10b3AtY29sb3I6cmdiKDE4NiwxODgsMjA5KTsgYm9yZGVyLXRvcC13aWR0aDoxcHQ7IGZvbnQt c2l6ZTppbml0aWFsOyB0ZXh0LWFsaWduOmluaXRpYWw7IGJhY2tncm91bmQtY29sb3I6cmdiKDI1 NSwyNTUsMjU1KSI+CjwvZGl2Pgo8YnI+CjxkaXY+CjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+ CjxwIGNsYXNzPSJNc29Ob3JtYWwiPlNvbWUgUk5HcyAoaW5jbHVkaW5nIHNvbWUgdmVyc2lvbnMg b2YgTGludXggL2Rldi9yYW5kb20pIGhhdmUgYW4gaW50ZXJmYWNlIHRoYXQgZXhwb3NlcyB0aGUg ZXN0aW1hdGVkIGFtb3VudCBvZiBlbnRyb3B5IGluIHRoZSBzZWNyZXQgc3RhdGUgb2YgdGhlIFJO Ry48L3A+CjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzwvcD4KPHAgY2xhc3M9Ik1zb05vcm1h bCI+SWYgYW4gYWR2ZXJzYXJ5IGdhaW5zIGFjY2VzcyB0byB0aGlzIGludGVyZmFjZSwgdGhlbiB0 aGVyZSBpcyBhIHNtYWxsIHJpc2sgdGhhdCBzZW5zaXRpdmUgaW5mb3JtYXRpb24gbGVha3MgdG8g dGhlIGFkdmVyc2FyeSwgYmVjYXVzZSB0aGUgZW50cm9weSBlc3RpbWF0ZSBtYXkgYmUgZGVyaXZl ZCBmcm9tIGFuZCBjb3JyZWxhdGVkIHRvIHNlbnNpdGl2ZSBpbmZvcm1hdGlvbi4mbmJzcDsKPC9w Pgo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8L3A+CjxwIGNsYXNzPSJNc29Ob3JtYWwiPkp1 c3QgdG8gYmUgY2xlYXIsIEkgZG8gbm90IHNlZSB0aGlzIHRvIGJlIGEgc2VyaW91cyByaXNrLiZu YnNwOyBJdCB3b3VsZCBiZSBkaWZmaWN1bHQgdG8gZXhwbG9pdC4mbmJzcDsgWWV0IEkgZG8gbm90 IHNlZSBlbm91Z2ggYmVuZWZpdCBpbiB0aGlzIGludGVyZmFjZSB0byBzdXBwb3J0IHRha2luZyB0 aGlzIHJpc2suJm5ic3A7CjwvcD4KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PC9wPgo8cCBj bGFzcz0iTXNvTm9ybWFsIj5UaGlzIGlzc3VlIGhhcyBwcm9iYWJseSBiZWVuIGRpc2N1c3NlZCBl bHNld2hlcmUsIG1heWJlIHdpdGggZGlmZmVyZW50IGNvbmNsdXNpb25zIGZyb20sIGFuZCBiZXR0 ZXIgcmVhc29uaW5nIHRoYW4sIG1pbmUuJm5ic3A7IElmIHNvLCB0aGVuIGEgcmVwbHkgY291bGQg anVzdCBwb2ludCB0byB0aG9zZSBkaXNjdXNzaW9ucy48L3A+CjxwIGNsYXNzPSJNc29Ob3JtYWwi PiZuYnNwOzwvcD4KPHAgY2xhc3M9Ik1zb05vcm1hbCI+LS0tPC9wPgo8cCBjbGFzcz0iTXNvTm9y bWFsIj4mbmJzcDs8L3A+CjxwIGNsYXNzPSJNc29Ob3JtYWwiPk1vcmUgZGV0YWlsIHNrZXRjaGVk IG91dCBiZWxvdzo8L3A+CjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzwvcD4KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+VGhlIGVudHJvcHkgaW4gdGhlIFJORyBtdXN0IG5lY2Vzc2FyaWx5IGJlIGRl cml2ZWQgZnJvbSBzZWNyZXQgc291cmNlcy4gJm5ic3A7SW4gbWFueSBzeXN0ZW1zLCB0aGUgc2Vj cmV0IHNvdXJjZXMgaW5jbHVkZSB0aGluZ3MgbGlrZSBrZXlib2FyZCBpbnB1dCB0aW1pbmdzLCB3 aGljaCBjYW4gYmUgZnVydGhlciBjbGFzc2lmaWVkIGFzIHNlbnNpdGl2ZSBzb3VyY2VzLiZuYnNw OyBUaGUgZXN0aW1hdGVkIGVudHJvcHkgaXMgYWxzbwogZGVyaXZlZCBpbiBzb21lIHdheSBmcm9t IHRoZXNlIHNlY3JldCBzZW5zaXRpdmUgc291cmNlcy4mbmJzcDsgVGhpcyBkZXJpdmF0aW9uIG9m IHRoZSBlc3RpbWF0ZWQgZW50cm9weSBpcyBub3QgZ2VuZXJhbGx5IGEgY3J5cHRvZ3JhcGhpY2Fs bHkgc3Ryb25nIG9uZS13YXkgZnVuY3Rpb24uJm5ic3A7IEZ1cnRoZXJtb3JlLCB0aGUgdGltaW5n IGluZm9ybWF0aW9uIG1pZ2h0IGJlIGxlYWtlZCBldmVuIGlmIGVzdGltYXRpb24gaXMgc29tZWhv dyBvbmUtd2F5LiZuYnNwOyBUaGVyZWZvcmUsCiB0aGUgaW50ZXJmYWNlcyBsZWFrcyBpbmZvcm1h dGlvbiBhYm91dCB0aGUgc2Vuc2l0aXZlIHNvdXJjZXMuJm5ic3A7IDwvcD4KPHAgY2xhc3M9Ik1z b05vcm1hbCI+Jm5ic3A7PC9wPgo8cCBjbGFzcz0iTXNvTm9ybWFsIj5Gb3IgYSBjb25jcmV0ZSBl eGFtcGxlLCB0aGUgaW50ZXJmYWNlIG1pZ2h0IGxlYWsgaW5mb3JtYXRpb24gYWJvdXQgdGhlIGtl eWJvYXJkIHRpbWluZ3MsIHdoaWNoIG1pZ2h0IGluIHR1cm4gbGVhayBpbmZvcm1hdGlvbiBhYm91 dCB0aGUgdmFsdWVzIG9mIHRoZSBrZXkgaW5wdXRzIChpZiwgc2F5LCB0aGVyZSBpcyBhIGNvcnJl bGF0aW9uIGJldHdlZW4gdGhlIHZhbHVlcyBhbmQgdGltaW5ncywgd2hpY2ggbWlnaHQKIGJlIHRo ZSBjYXNlLCBpZiBzYXkgdGhlIGRpZmZlcmVuY2Uga2V5LWRvd24gYW5kIGtleS11cCB0aW1lcyB2 YXJ5IHNpZ25pZmljYW50bHkgYmV0d2VlbiBkaWZmZXJlbnQga2V5Ym9hcmQgaW5wdXRzKS48L3A+ CjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzwvcD4KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SSBk b26SdCBzZWUgbXVjaCB2YWx1ZSBvZiBwcm92aWRpbmcgdGhpcyBlc3RpbWF0ZWQtZW50cm9weSBp bnRlcmZhY2UgYXQgYWxsLiZuYnNwOyBBcmd1YWJseSwgc3lzdGVtIGFkbWluaXN0cmF0b3JzIG1p Z2h0IGZpbmQgaXQgdXNlZnVsIHRvIGtub3cgd2hldGhlciB0aGUgc3lzdGVtIGlzIGluIGEgc2Vj dXJlIHN0YXRlIChwZXJoYXBzIHRvIGRpYWdub3NlIHNvbWUga2luZCBvZiBwcm9ibGVtKS4gT2J2 aW91c2x5LCB0aGlzCiBpbnRlcmZhY2UgZG9lcyBub3QgZXNjYWxhdGUgYSBzeXN0ZW0gYWRtaW5p c3RyYXRvcpJzIGFscmVhZHkgaGlnaCBwcml2aWxlZ2VzLiAmbmJzcDtCdXQgcHJvdmlkaW5nIHRo aXMgaW50ZXJmYWNlIHRvIG5vbi1wcml2aWxlZ2VkIHByb2Nlc3NlcyByaXNrcyBleHBvc3VyZSBv ZiBzZW5zaXRpdmUgaW5mb3JtYXRpb24gdG8gdW5hdXRob3JpemVkIHByb2Nlc3Nlcy48L3A+Cjxw IGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzwvcD4KPHAgY2xhc3M9Ik1zb05vcm1hbCI+QSBzaW1w bGUgd2F5IHRvIHJlZHVjZSB0aGlzIHJpc2sgd291bGQgYmUgdG8gZGVueSBhY2Nlc3MgdG8gbm9u LXByaXZpbGVnZWQgdXNlcnMsIGRpc2FsbG93aW5nIHRoZW0gdG8gc2VlIHRoZSBydW4tdGltZSBl bnRyb3B5IGVzdGltYXRlLjwvcD4KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PC9wPgo8cCBj bGFzcz0iTXNvTm9ybWFsIj5BIG1vcmUgc2V2ZXJlIHJlY29tbWVuZGF0aW9uIChCYXJhayBhbmQg SGFsZXZpLCA8YSBocmVmPSJodHRwOi8vaWEuY3IvMjAwNS8wMjkiPgpodHRwOi8vaWEuY3IvMjAw NS8wMjk8L2E+KSBpcyB0byBub3Qga2VlcCBhIHJ1bi10aW1lIGVzdGltYXRlIG9mIGVudHJvcHku Jm5ic3A7IDwvcD4KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PC9wPgo8cCBjbGFzcz0iTXNv Tm9ybWFsIj5CdXQgc29tZSBzZWN1cml0eSBnb2FscyBkbyBuZWVkIGxpdmUgZW50cm9weSwgd2hp Y2ggbWlnaHQgc3VnZ2VzdCB1c2luZyBzb21lIGxpbWl0ZWQgcnVuLXRpbWUgZW50cm9weSBlc3Rp bWF0aW9uLiZuYnNwOyBGb3IgZXhhbXBsZSwgTklTVCBTUCA4MDAtOTAqIHN0YW5kYXJkcyBoYXZl IGEgbm90aW9uIG9mIHByZWRpY3Rpb24gcmVzaXN0YW5jZSAod2hpY2ggaXMgc2ltaWxhciBvZiBM aW51eCAvZGV2L3JhbmRvbZJzIGJsb2NraW5nCiBpbnRlcmZhY2UpLiZuYnNwOyAmbmJzcDtJbiB0 aGlzIG1vZGUsIHRoZSBSTkcgd2FpdHMgdW50aWwgaXQgZGVlbXMgaXQgaGFzIGVub3VnaCwgcHJl c3VtYWJseSBmcmVzaCBlbnRyb3B5LiZuYnNwOyBUaGUgb3N0ZW5zaWJsZSBwdXJwb3NlIGlzIHRv IHJlY292ZXIgZnJvbSBwYXN0IHRlbXBvcmFyeSBzdGF0ZS1leHBvc3VyZXMuJm5ic3A7IFRoZSBO SVNUIGFwcHJvYWNoIGlzIGdhdGhlciB0byBmcmVzaCBlbnRyb3B5IGZyb20gYSBsaXZlIG5vaXNl IHNvdXJjZS4mbmJzcDsgSWYgdGhpcyBub2lzZQogc291cmNlIGhhcyBpdHMgZW50cm9weSBhc3Nl c3NlZCBvbmx5IGF0IGRlc2lnbiB0aW1lLCBub3QgYXQgcnVuLXRpbWUsIHRoZW4gQmFyYWsgYW5k IEhhbGV2aZJzIHJlY29tbWVuZGF0aW9uIChvZiBubyBydW4tdGltZSBlbnRyb3B5IGVzdGltYXRp b24pLCBjYW4gYmUgZm9sbG93ZWQuIFRoZSBOSVNUIHN0YW5kYXJkcyBtaWdodCwgaG93ZXZlciwg aGF2ZSBzb21lIG1pbGQgaGVhbHRoIHRlc3QgY2hlY2tzIG9mIGVudHJvcHkgc291cmNlLCB3aGlj aAogb25seSBhaW0gdG8gZGV0ZWN0IHNldmVyZSBmYWlsdXJlLCBtYWtpbmcgdGhlbSBvbmx5IG1p bGRseSBpbmNvbXBhdGlibGUgd2l0aCB0aGUgQmFyYWstSGFsZXZpIGFwcHJvYWNoLiZuYnNwOwo8 L3A+CjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzwvcD4KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ SWYgSSB1bmRlcnN0YW5kIGNvcnJlY3RseSwgdGhlIHJlY2VudCAvZGV2L3JhbmRvbSBhcHByb2Fj aGVzIGFyZSB0byBkZWNyZWFzZSB0aGUgZXN0aW1hdGUgZW50cm9weSBvbiBhbiBvbmdvaW5nIGJh c2lzIChzdWNoIGFzIGR1cmluZyBjYWxscyAvZGV2L3JhbmRvbSksIHRvIGVuc3VyZSB0aGUgY3Vy cmVudCBwb29sIGlzIGRlZW1lZCB0byBiZSBmcmVzaCBlbnRyb3B5LiAmbmJzcDsmbmJzcDtUaGUg ZnJlc2huZXNzIHNvIG9idGFpbmVkCiBtaWdodCBoYXZlIGEgcHVycG9zZSBzaW1pbGFyIHRvIE5J U1SScyBzZWN1cml0eSBnb2FsIG9mIHByZWRpY3Rpb24gcmVzaXN0YW5jZSAocmVjb3ZlcnkgZnJv bSB0ZW1wb3Jhcnkgc3RhdGUtY29tcHJvbWlzZSkuJm5ic3A7IFVuZm9ydHVuYXRlbHksIHRoaXMg c3RlcCBvZiBkZWNyZWFzaW5nIHRoZSBlbnRyb3B5IGVzdGltYXRlIGluY3JlYXNlcyB0aGUgcmlz ayBvZiB0aGUgaW50ZXJmYWNlLiZuYnNwOyAmbmJzcDtGb3IgZXhhbXBsZSwgaWYgdGhlIGVudHJv cHkgaXMgaW4KIGEgbmVhciBmdWxsIHN0YXRlLCB0aGVuIC9kZXYvcmFuZG9tIG1pZ2h0IGNlYXNl IHRvIGluY3JlYXNlIGl0cyBlbnRyb3B5IGVzdGltYXRlLiZuYnNwOyBJbiB0aGlzIGZ1bGwgc3Rh dGUsIHRoZSBsZWFrIGlzIHJlZHVjZWQgb3Igc3RvcHBlZCwgYmVjYXVzZSB0aGUgZW50cm9weSBl c3RpbWF0ZSBkb2VzIG5vdCBjaGFuZ2UgYXMgb2Z0ZW4uICZuYnNwO1RvIGNpcmN1bXZlbnQgdGhp cyBvYnN0YWNsZSwgdGhlIGFkdmVyc2FyeSBjYW4gZHJhdyBkb3duIHRoZSBlbnRyb3B5CiBlc3Rp bWF0ZSBieSBjYWxsaW5nIC9kZXYvcmFuZG9tLCB0aGVyZWJ5IGNhdXNlIHRoZSBSTkcgdG8gZGVj cmVhc2UgaXRzIGVudHJvcHkgZXN0aW1hdGUuJm5ic3A7IEluIHNvIGRvaW5nLCB0aGUgYWR2ZXJz YXJ5IGNhbiBjaGFuZ2UgdGhlIFJORyBzdGF0ZSBmcm9tIG5vbi1sZWFreSBiYWNrIHRvIGxlYWt5 LiZuYnNwOyAoVGhlIGlzc3VlIG9mIGNhbGxzIHRvIC9kZXYvcmFuZG9tIGJlaW5nIGFidXNlZCBm b3IgYW5vdGhlciBwdXJwb3NlIHRvIGNhdXNlIGEgZGVuaWFsCiBvZiBzZXJ2aWNlIGhhcyBhbHJl YWR5IGJlZW4gbGFyZ2VseSBtaXRpZ2F0ZWQgYnkgY2hhbmdlcyBpbiB0aGUgL2Rldi9yYW5kb20g c3lzdGVtLik8L3A+CjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzwvcD4KPHAgY2xhc3M9Ik1z b05vcm1hbCI+VGhlIGVudHJvcHkgZXN0aW1hdGUgaW50ZXJmYWNlIGV4cG9zZXMgbW9yZSBpbmZv cm1hdGlvbiB0aGFuIHRoZSBibG9ja2luZyBiZWhhdmlvciBvZiBzb21ldGhpbmcgbGlrZSAvZGV2 L3JhbmRvbSwgaW4gdGhhdCB0aGUgZW50cm9weSBlc3RpbWF0ZSBudW1iZXJzIGNvbnRhaW4gbW9y ZSBpbmZvcm1hdGlvbiB0aGFuIHRoZSBzaW5nbGUgYml0IG9mIGJsb2NrZWQvbm9uLWJsb2NrZWQg c3RhdGUsIGFuZCBmdXJ0aGVyCiB0aGUgZW50cm9weSBlc3RpbWF0ZSBjaGFuZ2VzIG1vcmUgZnJl cXVlbnRseSB0aGFuIHRoZSBibG9ja2luZyBzdGF0ZS4mbmJzcDsgQnV0IGV2ZW4gdGhlIGJsb2Nr aW5nIGJlaGF2aW9yIG9mIC9kZXYvcmFuZG9tIGhhcyB0aGUgcG90ZW50aWFsIHRvIGxlYWsgYSBt aW5pc2N1bGUgaW5mb3JtYXRpb24sIHN1Y2ggYXMgdGhlIHRpbWluZyBpbmZvcm1hdGlvbi4mbmJz cDsgRm9yIGV4YW1wbGUsIGEgbWFsaWNpb3VzIG5vbi1wcml2aWxlZ2VkIHByb2Nlc3MgbWlnaHQg Y2FsbAogL2Rldi9yYW5kb20gdmVyeSBmcmVxdWVudGx5IHVudGlsIGl0IGJsb2Nrcy4mbmJzcDsg V2hldGhlciBhbm90aGVyIHVzZXIsIHNheSB0aGUgc3lzdGVtIGFkbWluaXN0cmF0b3IsIG9uIHRo ZSBzeXN0ZW0gdHlwZXMgc2Vuc2l0aXZlIGtleWJvYXJkIGlucHV0IGludG8gYW5vdGhlciBwcm9j ZXNzLCAvZGV2L3JhbmRvbSBtYXkgdW5ibG9jay4mbmJzcDsgVGhlIG1hbGljaW91cyBwcm9jZXNz IGNhbiB0aGVuIGdhdGhlciBzb21lIHRpbWluZyBpbmZvcm1hdGlvbiBhYm91dAogdGhlIGtleWJv YXJkIGlucHV0cy4mbmJzcDsgSSBzZWUgdGhpcyBhcyBhIG11Y2ggc21hbGxlciByaXNrLCB3aGlj aCBpcyBhcmd1YWJseSB3b3J0aCB0aGUgYmVuZWZpdCBvZiB0aGUgcHJlZGljdGlvbiByZXNpc3Rh bmNlIHByb3BlcnRpZXMgb2YgL2Rldi9yYW5kb20uJm5ic3A7IEFnYWluLCB0aGUgcmVhc29uIGl0 IGlzIHNtYWxsZXIgcmlzayBpcyB0aGF0IGJsb2NraW5nIHN0YXRlIGNoYW5nZXMgbXVjaCBsZXNz IGZyZXF1ZW50bHkgdGhhbiB0aGUgZW50cm9weQogZXN0aW1hdGUuJm5ic3A7IE1vbml0b3Jpbmcg Y2hhbmdlcyBpbiB0aGUgZW50cm9weSBlc3RpbWF0ZSBjYW4gdGhlcmVmb3JlIG11Y2ggbW9yZSBw cmVjaXNlIHRpbWluZyBpbmZvcm1hdGlvbi48L3A+CjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNw OzwvcD4KPHAgY2xhc3M9Ik1zb05vcm1hbCI+QmVzdCByZWdhcmRzLDwvcD4KPHAgY2xhc3M9Ik1z b05vcm1hbCI+Jm5ic3A7PC9wPgo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjkuMHB0OyBmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmOyBj b2xvcjpibGFjayI+RGFuIEJyb3duPGJyPgo8YnI+Cjwvc3Bhbj48c3BhbiBzdHlsZT0iIj48YSBo cmVmPSJodHRwOi8vd3d3LmJsYWNrYmVycnkuY29tLyI+PGltZyBib3JkZXI9IjAiIHdpZHRoPSIz MiIgaGVpZ2h0PSIzMiIgc3JjPSJjaWQ6aW1hZ2UwMDEucG5nQDAxRDI0OTZELkI5MThBQTMwIiBh bHQ9IkJsYWNrQmVycnkiIHRpdGxlPSIiIHN0eWxlPSJ3aWR0aDouMzMzM2luOyBoZWlnaHQ6LjMz MzNpbiI+PC9hPjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0OyBmb250LWZhbWls eTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmOyBjb2xvcjpibGFjayI+PC9zcGFuPjwvcD4K PHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PC9wPgo8L2Rpdj4KLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tPGJyPgpU aGlzIHRyYW5zbWlzc2lvbiAoaW5jbHVkaW5nIGFueSBhdHRhY2htZW50cykgbWF5IGNvbnRhaW4g Y29uZmlkZW50aWFsIGluZm9ybWF0aW9uLCBwcml2aWxlZ2VkIG1hdGVyaWFsIChpbmNsdWRpbmcg bWF0ZXJpYWwgcHJvdGVjdGVkIGJ5IHRoZSBzb2xpY2l0b3ItY2xpZW50IG9yIG90aGVyIGFwcGxp Y2FibGUgcHJpdmlsZWdlcyksIG9yIGNvbnN0aXR1dGUgbm9uLXB1YmxpYyBpbmZvcm1hdGlvbi4g QW55IHVzZSBvZiB0aGlzIGluZm9ybWF0aW9uCiBieSBhbnlvbmUgb3RoZXIgdGhhbiB0aGUgaW50 ZW5kZWQgcmVjaXBpZW50IGlzIHByb2hpYml0ZWQuIElmIHlvdSBoYXZlIHJlY2VpdmVkIHRoaXMg dHJhbnNtaXNzaW9uIGluIGVycm9yLCBwbGVhc2UgaW1tZWRpYXRlbHkgcmVwbHkgdG8gdGhlIHNl bmRlciBhbmQgZGVsZXRlIHRoaXMgaW5mb3JtYXRpb24gZnJvbSB5b3VyIHN5c3RlbS4gVXNlLCBk aXNzZW1pbmF0aW9uLCBkaXN0cmlidXRpb24sIG9yIHJlcHJvZHVjdGlvbiBvZiB0aGlzIHRyYW5z bWlzc2lvbgogYnkgdW5pbnRlbmRlZCByZWNpcGllbnRzIGlzIG5vdCBhdXRob3JpemVkIGFuZCBt YXkgYmUgdW5sYXdmdWwuPGJyPgo8L2Rpdj4KLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tPGJyPlRoaXMgdHJhbnNtaXNz aW9uIChpbmNsdWRpbmcgYW55IGF0dGFjaG1lbnRzKSBtYXkgY29udGFpbiBjb25maWRlbnRpYWwg aW5mb3JtYXRpb24sIHByaXZpbGVnZWQgbWF0ZXJpYWwgKGluY2x1ZGluZyBtYXRlcmlhbCBwcm90 ZWN0ZWQgYnkgdGhlIHNvbGljaXRvci1jbGllbnQgb3Igb3RoZXIgYXBwbGljYWJsZSBwcml2aWxl Z2VzKSwgb3IgY29uc3RpdHV0ZSBub24tcHVibGljIGluZm9ybWF0aW9uLiBBbnkgdXNlIG9mIHRo aXMgaW5mb3JtYXRpb24gYnkgYW55b25lIG90aGVyIHRoYW4gdGhlIGludGVuZGVkIHJlY2lwaWVu dCBpcyBwcm9oaWJpdGVkLiBJZiB5b3UgaGF2ZSByZWNlaXZlZCB0aGlzIHRyYW5zbWlzc2lvbiBp biBlcnJvciwgcGxlYXNlIGltbWVkaWF0ZWx5IHJlcGx5IHRvIHRoZSBzZW5kZXIgYW5kIGRlbGV0 ZSB0aGlzIGluZm9ybWF0aW9uIGZyb20geW91ciBzeXN0ZW0uIFVzZSwgZGlzc2VtaW5hdGlvbiwg ZGlzdHJpYnV0aW9uLCBvciByZXByb2R1Y3Rpb24gb2YgdGhpcyB0cmFuc21pc3Npb24gYnkgdW5p bnRlbmRlZCByZWNpcGllbnRzIGlzIG5vdCBhdXRob3JpemVkIGFuZCBtYXkgYmUgdW5sYXdmdWwu PGJyPjwvYm9keT4KPC9odG1sPgo= --_000_201612160206205705805179698573blackberrycom_-- --_004_201612160206205705805179698573blackberrycom_ Content-Type: image/png; name="image001.png" Content-Description: image001.png Content-Disposition: inline; filename="image001.png"; size=174; creation-date="Mon, 28 Nov 2016 16:51:15 GMT"; modification-date="Mon, 28 Nov 2016 16:51:15 GMT" Content-ID: Content-Transfer-Encoding: base64 iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAMAAABEpIrGAAAAAXNSR0ICQMB9xQAAAANQTFRFAAAA p3o92gAAAAF0Uk5TAEDm2GYAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAAZdEVYdFNvZnR3YXJlAE1p Y3Jvc29mdCBPZmZpY2V/7TVxAAAAEklEQVQ4y2NgGAWjYBSMAuwAAAQgAAFWu83mAAAAAElFTkSu QmCC --_004_201612160206205705805179698573blackberrycom_-- From nobody Thu Dec 15 18:42:59 2016 Return-Path: X-Original-To: dsfjdssdfsd@ietfa.amsl.com Delivered-To: dsfjdssdfsd@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5742F1297ED for ; Thu, 15 Dec 2016 18:42:58 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YrLiEWdPCZmO for ; Thu, 15 Dec 2016 18:42:57 -0800 (PST) Received: from mail.proper.com (Opus1.Proper.COM [207.182.41.91]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 190681293E1 for ; Thu, 15 Dec 2016 18:42:57 -0800 (PST) Received: from [10.32.60.129] (50-1-51-163.dsl.dynamic.fusionbroadband.com [50.1.51.163]) (authenticated bits=0) by mail.proper.com (8.15.2/8.14.9) with ESMTPSA id uBG2gLHo036887 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Thu, 15 Dec 2016 19:42:22 -0700 (MST) (envelope-from paul.hoffman@vpnc.org) X-Authentication-Warning: mail.proper.com: Host 50-1-51-163.dsl.dynamic.fusionbroadband.com [50.1.51.163] claimed to be [10.32.60.129] From: "Paul Hoffman" To: "Dan Brown" Date: Thu, 15 Dec 2016 18:42:53 -0800 Message-ID: In-Reply-To: <20161216020620.5705805.17969.8573@blackberry.com> References: <810C31990B57ED40B2062BA10D43FBF501083C12@XMB116CNC.rim.net> <20161216020620.5705805.17969.8573@blackberry.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit X-Mailer: MailMate (1.9.6r5310) Archived-At: Cc: "dsfjdssdfsd@ietf.org" Subject: Re: [dsfjdssdfsd] Any readers here? Re: Risks of entropy available X-BeenThere: dsfjdssdfsd@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "The dsfjdssdfsd list provides a venue for discussion of randomness in IETF protocols, for example related to updating RFC 4086." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Dec 2016 02:42:58 -0000 On 15 Dec 2016, at 18:06, Dan Brown wrote: > Is anybody still reading this list? At least one person. :-) > Not sure if my previous post below was clear enough, ‎but if it was > clear and if it was read, then maybe it's just not concerning enough > to justify a reply? It was clear and not concerning. If an adversary gets access to the /dev/random interface, that adversary probably has lots of similar access and therefore much worse things are likely to happen. --Paul Hoffman From prashantinq@gmail.com Fri Dec 16 00:47:02 2016 Return-Path: X-Original-To: dsfjdssdfsd@ietfa.amsl.com Delivered-To: dsfjdssdfsd@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6EE51129ACE for ; Fri, 16 Dec 2016 00:47:02 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hVZqhE_7HB66 for ; Fri, 16 Dec 2016 00:47:00 -0800 (PST) Received: from mail-qk0-x241.google.com (mail-qk0-x241.google.com [IPv6:2607:f8b0:400d:c09::241]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2F780129AC7 for ; Fri, 16 Dec 2016 00:47:00 -0800 (PST) Received: by mail-qk0-x241.google.com with SMTP id h201so10550953qke.3 for ; Fri, 16 Dec 2016 00:47:00 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:in-reply-to:references:mime-version:date:message-id:subject:to :content-transfer-encoding; bh=bRGb9Gizp80mTTufReFGiQOnKJUaXQVeFA6kSfgkrSg=; b=WzXJt0sOqCWszhJA9IHbn8Kd6dPQeozGq1UI5Bq+b1oQcmwSIHfflxaNgECgzXReTt mKL2RDBg2P20pSpCL3V3Iqxrmdbti3+agaB5WZIYlolnVx84SHHGvI5TcaPpg1HmTI6+ 5e8jLtumT2o6l1OiJa6f/8jFVKc57ZtWdHECy4ZHdw4MZIv307Eu8481iBwgYXzq+9Kh dBazLkgjeCKVAzNS8/jOXz/mjTR3pHvpnO9blsuSEzY/TJpjNXrR9Sr6FWBMds0Nz9g1 xwzqGBeDZjH/Y3ZRIzaoyWMrjb5Gruy8f7KPOIa5PnL0+jrGdy/Gdfy5/8WzKfS+e71K /X8g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:in-reply-to:references:mime-version:date :message-id:subject:to:content-transfer-encoding; bh=bRGb9Gizp80mTTufReFGiQOnKJUaXQVeFA6kSfgkrSg=; b=lrkljZ+1Pngz03GyLwMWMbmAxPX1hMjK4ogRr4dxEEx01O4/TzpmwScB0c6Op8Whyu C6hEXtf0jlXC3LfumtUVpqp8Qgqx3Vuj54nY/3LSs2rUKSCAzpP4kWriqlGXUABi5tc5 /GA3uAGbVDt6PT9uUjRn/aIUDRV1l4SqeWGn7X2i54tR/lOpsWsGekgqHhHFoUlBQwoh cg299sBUm5SVkyVrlqj2QljVdazGg0+f64n4DepOENs1SfaKxzSaAldkg0auAJ1OoFA8 J9lfjU8xjHiRC5iyK4uaaRFQtKREcSSAbSNLr9EtXrqShjRC4qHeQfFV0s+nk1Rzouhb sr5w== X-Gm-Message-State: AIkVDXLEdz6aEajgZ6TcU3bcirQPOwDW9n/2pyIlld+1cTS8TK6H88eNZcHspWkdd/SPF8tnJl5xzCVa4hMihw== X-Received: by 10.55.102.138 with SMTP id a132mr1478538qkc.57.1481878019196; Fri, 16 Dec 2016 00:46:59 -0800 (PST) Received: from 1058052472880 named unknown by gmailapi.google.com with HTTPREST; Fri, 16 Dec 2016 00:46:58 -0800 From: Prashant Sinha In-Reply-To: References: X-Mailer: Airmail (397) MIME-Version: 1.0 Date: Fri, 16 Dec 2016 00:46:58 -0800 Message-ID: To: dsfjdssdfsd@ietf.org Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Archived-At: X-Mailman-Approved-At: Fri, 16 Dec 2016 07:57:53 -0800 Subject: Re: [dsfjdssdfsd] dsfjdssdfsd Digest, Vol 9, Issue 1 X-BeenThere: dsfjdssdfsd@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "The dsfjdssdfsd list provides a venue for discussion of randomness in IETF protocols, for example related to updating RFC 4086." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Dec 2016 13:21:46 -0000 Not sure how I missed it, but yeah, least I read the thread. -Prashant On 16 December 2016 at 08:13:13, dsfjdssdfsd-request@ietf.org (dsfjdssdfsd-request@ietf.org) wrote: > Send dsfjdssdfsd mailing list submissions to > dsfjdssdfsd@ietf.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://www.ietf.org/mailman/listinfo/dsfjdssdfsd > or, via email, send a message with subject or body 'help' to > dsfjdssdfsd-request@ietf.org > > You can reach the person managing the list at > dsfjdssdfsd-owner@ietf.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of dsfjdssdfsd digest..." > Today's Topics: > > 1. Any readers here? Re: Risks of entropy available (Dan Brown) > 2. Re: Any readers here? Re: Risks of entropy available > (Paul Hoffman) > Is anybody still reading this list? > > Not sure if my previous post below was clear enough, =E2=80=8Ebut if it w= as clear and if it was read, > then maybe it's just not concerning enough to justify a reply? > > Sent from my BlackBerry 10 smartphone on the Rogers network. > From: Dan Brown > Sent: Monday, November 28, 2016 11:51 AM > To: dsfjdssdfsd@ietf.org > Subject: [dsfjdssdfsd] Risks of entropy available > > > Some RNGs (including some versions of Linux /dev/random) have an interfac= e that exposes > the estimated amount of entropy in the secret state of the RNG. > > If an adversary gains access to this interface, then there is a small ris= k that sensitive > information leaks to the adversary, because the entropy estimate may be d= erived from > and correlated to sensitive information. > > Just to be clear, I do not see this to be a serious risk. It would be dif= ficult to exploit. > Yet I do not see enough benefit in this interface to support taking this = risk. > > This issue has probably been discussed elsewhere, maybe with different co= nclusions > from, and better reasoning than, mine. If so, then a reply could just poi= nt to those discussions. > > --- > > More detail sketched out below: > > The entropy in the RNG must necessarily be derived from secret sources. I= n many systems, > the secret sources include things like keyboard input timings, which can = be further > classified as sensitive sources. The estimated entropy is also derived in= some way from > these secret sensitive sources. This derivation of the estimated entropy = is not generally > a cryptographically strong one-way function. Furthermore, the timing info= rmation > might be leaked even if estimation is somehow one-way. Therefore, the int= erfaces leaks > information about the sensitive sources. > > For a concrete example, the interface might leak information about the ke= yboard timings, > which might in turn leak information about the values of the key inputs (= if, say, there > is a correlation between the values and timings, which might be the case,= if say the difference > key-down and key-up times vary significantly between different keyboard i= nputs). > > I don=E2=80=99t see much value of providing this estimated-entropy interf= ace at all. Arguably, > system administrators might find it useful to know whether the system is = in a secure state > (perhaps to diagnose some kind of problem). Obviously, this interface doe= s not escalate > a system administrator=E2=80=99s already high privileges. But providing t= his interface to > non-privileged processes risks exposure of sensitive information to unaut= horized > processes. > > A simple way to reduce this risk would be to deny access to non-privilege= d users, disallowing > them to see the run-time entropy estimate. > > A more severe recommendation (Barak and Halevi, http://ia.cr/2005/029) is= to not keep > a run-time estimate of entropy. > > But some security goals do need live entropy, which might suggest using s= ome limited > run-time entropy estimation. For example, NIST SP 800-90* standards have = a notion of > prediction resistance (which is similar of Linux /dev/random=E2=80=99s bl= ocking interface). > In this mode, the RNG waits until it deems it has enough, presumably fres= h entropy. The > ostensible purpose is to recover from past temporary state-exposures. The= NIST approach > is gather to fresh entropy from a live noise source. If this noise source= has its entropy > assessed only at design time, not at run-time, then Barak and Halevi=E2= =80=99s recommendation > (of no run-time entropy estimation), can be followed. The NIST standards = might, however, > have some mild health test checks of entropy source, which only aim to de= tect severe failure, > making them only mildly incompatible with the Barak-Halevi approach. > > If I understand correctly, the recent /dev/random approaches are to decre= ase the estimate > entropy on an ongoing basis (such as during calls /dev/random), to ensure= the current > pool is deemed to be fresh entropy. The freshness so obtained might have = a purpose similar > to NIST=E2=80=99s security goal of prediction resistance (recovery from t= emporary state-compromise). > Unfortunately, this step of decreasing the entropy estimate increases the= risk of the > interface. For example, if the entropy is in a near full state, then /dev= /random might > cease to increase its entropy estimate. In this full state, the leak is r= educed or stopped, > because the entropy estimate does not change as often. To circumvent this= obstacle, > the adversary can draw down the entropy estimate by calling /dev/random, = thereby cause > the RNG to decrease its entropy estimate. In so doing, the adversary can = change the RNG > state from non-leaky back to leaky. (The issue of calls to /dev/random be= ing abused for > another purpose to cause a denial of service has already been largely mit= igated by changes > in the /dev/random system.) > > The entropy estimate interface exposes more information than the blocking= behavior > of something like /dev/random, in that the entropy estimate numbers conta= in more information > than the single bit of blocked/non-blocked state, and further the entropy= estimate > changes more frequently than the blocking state. But even the blocking be= havior of /dev/random > has the potential to leak a miniscule information, such as the timing inf= ormation. For > example, a malicious non-privileged process might call /dev/random very f= requently > until it blocks. Whether another user, say the system administrator, on t= he system types > sensitive keyboard input into another process, /dev/random may unblock. T= he malicious > process can then gather some timing information about the keyboard inputs= . I see this > as a much smaller risk, which is arguably worth the benefit of the predic= tion resistance > properties of /dev/random. Again, the reason it is smaller risk is that b= locking state > changes much less frequently than the entropy estimate. Monitoring change= s in the entropy > estimate can therefore much more precise timing information. > > Best regards, > > Dan Brown > > [BlackBerry] > > --------------------------------------------------------------------- > This transmission (including any attachments) may contain confidential in= formation, > privileged material (including material protected by the solicitor-client= or other > applicable privileges), or constitute non-public information. Any use of = this information > by anyone other than the intended recipient is prohibited. If you have re= ceived this > transmission in error, please immediately reply to the sender and delete = this information > from your system. Use, dissemination, distribution, or reproduction of th= is transmission > by unintended recipients is not authorized and may be unlawful. > --------------------------------------------------------------------- > This transmission (including any attachments) may contain confidential in= formation, > privileged material (including material protected by the solicitor-client= or other > applicable privileges), or constitute non-public information. Any use of = this information > by anyone other than the intended recipient is prohibited. If you have re= ceived this > transmission in error, please immediately reply to the sender and delete = this information > from your system. Use, dissemination, distribution, or reproduction of th= is transmission > by unintended recipients is not authorized and may be unlawful. > On 15 Dec 2016, at 18:06, Dan Brown wrote: > > > Is anybody still reading this list? > > At least one person. :-) > > > Not sure if my previous post below was clear enough, =E2=80=8Ebut if it= was > > clear and if it was read, then maybe it's just not concerning enough > > to justify a reply? > > It was clear and not concerning. If an adversary gets access to the > /dev/random interface, that adversary probably has lots of similar > access and therefore much worse things are likely to happen. > > --Paul Hoffman > > > _______________________________________________ > dsfjdssdfsd mailing list > dsfjdssdfsd@ietf.org > https://www.ietf.org/mailman/listinfo/dsfjdssdfsd >