Subject: CGA Issue #10: Generating weak random numbers (Russ Housley)

From: "Tuomas Aura" <[email-masked]>
Date: Mon, 22 Mar 2004 13:38:45 -0800

Russ Housley:

  In the 1st full paragraph on page 9, Section 4 says:
  >
  > ... The quality of the random number generator does not affect the
  > strength of the binding between the address and the public key. ...
  >
  This kind of statement will encourage implementors to use a constant,
  which is a problem.  A SHA-1 hash of the time of day would be okay.

  Section 7.3 ought to reference RFC 1750.

---

Tuomas Aura:
  
It is true that using the time of day is much better for privacy than
using zero. It is a good idea to suggest a way fo generating weak
random numbers. 

I think using the unhashed time of day directly is just as good for 
privacy as hashing it. For remote nodes that only see the CGA and not 
the CGA Parameters, there is no difference because the time of day will 
be hashed anyway (with the Hash1 function). For local nodes that see 
the CGA Parameters, there is no real difference because they can do a 
brute-force reversal of the hash by trying all different time-of-day 
values. Thus, computing a SHA-1 hash of the time of day is unnecessary.

Some implementations may, however require the initial values to be
evenly distributed to all parts of the 128-bit modifier value space
in order to avoid searching the same number twice. Therefore, some 
kind of hashing is useful. 

I suggest the following wording:

  The quality of the random number generator does not affect the 
  strength of the binding between the address and the public key. 
  Implementations that have no strong random numbers available MAY
  use a non-cryptographic pseudo-random number generator that is
  initialized with the current time of day. 
  
To Section 7.3, I would add the following:

  Advice on random number generation can be found in [RFC1750].

--------------------------------------------------------------------
To unsubscribe from this list, send email with "UNSUBSCRIBE" in the
body to <[email-masked]>.
Archive: http://standards.ericsson.net/lists/ietf-send/maillist.html
--------------------------------------------------------------------

This communication is confidential and intended solely for the addressee(s). Any unauthorized review, use, disclosure or distribution is prohibited. If you believe this message has been sent to you in error, please notify the sender by replying to this transmission and delete the message without disclosing it. Thank you.

E-mail including attachments is susceptible to data corruption, interruption, unauthorized amendment, tampering and viruses, and we only send and receive e-mails on the basis that we are not liable for any such corruption, interception, amendment, tampering or viruses or any consequences thereof.

---

From: Pekka Nikander <[email-masked]>
Date: Mon, 29 Mar 2004 18:32:49 +0200

>   Advice on random number generation can be found in [RFC1750].

This looks ok to me, but Thuomas you need to get an opinion also 
directly
from Russ, I think.  But maybe you want to wait until this very lively
discussion at the WG mailing list is over :-)

--Pekka

---

From: Jari Arkko <[email-masked]>
Date: Wed, 31 Mar 2004 20:35:04 +0300

Your proposal Tuomas looks good.

--Jari