Subject: Re: Calculations of ISN for new TCP sessions

From: der Mouse <[email-masked]>
Date: Mon, 18 Sep 2000 14:39:18 -0400 (EDT)

> You don't need 32 bits of true randomness per ISN.  Once you have 128
> bits of true randomness you can safely get trillions of ISNs without
> giving an attacker a chance to recognize you're not using a true
> random number generator.

That statement sounds highly dubious to me.  What are your grounds for
making it?

That is, as far as I can see, you lose a certain amount of entropy with
each ISN you generate.  Your ISNs are only as unguessable as the amount
of entropy you drain off to generate each one.

And once you've no entropy left un-exposed, all you have left is a PRNG
whose internal state the attacker has to deduce.  This can be made
comparatively difficult, for example if you use a decent one-way
function between the entropy and the resulting ISN, but by no means
impossible.  In theory, the attacker could even brute-force it.

As for the attacker recognizing how you generate your ISNs, well, as
any crypto person will tell you, your security cannot, in more than the
short term, rest on keeping your algorithms themselves secret.

Or, of course, you could be lucky, and have hardware attached that
produces entropy faster than incoming connection attempts consume it.
Few of us are that lucky.

					der Mouse

			       [email-masked]
		     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B

---

From: stanislav shalunov <[email-masked]>
Date: 18 Sep 2000 20:11:05 -0400

> That statement sounds highly dubious to me.  What are your grounds for

Take that 128 bits of true ranodmness and use it as the key for AES
running in counter mode.  I believe it's accepted that about 2^{128/3}
blocks of output will be indistinguishable from truely random data by
attacker who cannot break the cipher in use.  (At least, I didn't ever
hear any cryptographer dispute this very conservative estimate.)

Have you looked at the Yarrow paper I gave a link to?

> of entropy you drain off to generate each one.

No.  The point is that once you have certain amount of entropy further
increases bring no real increase in security of the system.  Most
people still feel more comfortable with using "true" randomness to
generate things like long-living keys.

> impossible.  In theory, the attacker could even brute-force it.

I don't understand how you can brute-force something in theory.
Brute-force search of key space isn't theoretic.  It's practical.
If it's practically infeasible to search the key space, there's
nothing to worry about.

And 128 bits Ought to be Enough for Everybody(TM).  (But if they
aren't enough for you, you can always replace 128 with 640 or more.)

> short term, rest on keeping your algorithms themselves secret.

You must be responding to somebody else's comments here.

> produces entropy faster than incoming connection attempts consume it.

This is unnecessary, and, I think is prone to being less secure than a
decent PRNG.

I guess the short summary should be that cryptographers know how to
make good PRNGs, and they even give them away into public domain.
On the other hands, non-cryptographers--predictably--have less thorough
understanding of producing cryptographically secure PRNGs.

-- 
Stanislav Shalunov <[email-masked]>	Internet Engineer, Internet2

"The power of accurate observation is commonly called cynicism by
those who have not got it."			-- G. B. Shaw