/dev/random and virtual systems

http://www.mail-archive.com/cryptography@metzdowd.com/msg11533.html

by bobds • 15 years ago

48 40 15 years ago

stipes3• 15 years ago

I did some research work last semester on crypto inside VMs. One of our initial readings was Yilek's work on attacking VM crypto through VM snapshots http://cseweb.ucsd.edu/~syilek/ndss2010.html

tptacek13• 15 years ago

That's an interesting trick but not really representative of the problem. Reusing an RNG's entropy pool wholesale after restarting a snapshot is a mistake, not a design flaw.

stipes3• 15 years ago

Part of the problem is the conflict of transparency and security here. Fixing the wholesale reuse of RNG state would most likely require modifying the guest so that it is aware of being restarted from a snapshot so it can react appropriately.

However, that might have consequences on what restoring from a snapshot means conceptually.

yuhong2• 15 years ago

Not to mention that if you let untrusted people control VMs on the host side, you have bigger problems than this attack.

justincormack• 15 years ago

Most servers have little source of decent entropy. Virtualisation makes this worse. Intel has dropped the motherboard RNG support in their chipsets. The suggestion in the thread to use a few cheap VIA boxes which have CPU RNG is one idea. There are cheap USB rngs too like http://www.entropykey.co.uk/.

tptacek13• 15 years ago

There are even bigger concerns with crypto on virtualized hardware: side channels. We probably don't even know all the microarchitectural pathways that crypto code can leave footprints on, let alone how to deploy efficient general-purpose crypto code to obscure those footprints.

JonnieCache2• 15 years ago

Could you elaborate on this? My interesting stuff detector is going crazy but I'm kinda out of my depth as to what exactly you're talking about. Are you referring to information leakage from the guest to the host operating system that might allow the host to sniff the inner workings of crypto algorithms running on the guest? Or perhaps guests sniffing other guests through timing attacks and suchlike?

tptacek13• 15 years ago

Here's a fine starting point:

http://eprint.iacr.org/2006/351

ScottBurson• 15 years ago

In a previous job I worked for a company whose product needed some entropy on startup. It originally read from /dev/random. But then one of our customers reported that the product was hanging on startup, just after installation. It turned out that they had installed it into a freshly built VM (not a cloned one, I guess) and the read from /dev/random was waiting to accumulate enough entropy to return. (We changed it to use /dev/urandom instead, which is not entirely satisfactory, but at least prevents hanging in this situation.)

While this is not exactly the scenario the OP is describing, it's another thing that can go wrong with /dev/random and VMs.

nodata• 15 years ago

But that's not a problem with /dev/random and VMs, that's a problem everywhere.

eru• 15 years ago

But most bare-metal installations will only hang once.

cpeterso• 15 years ago

For servers and VMs without much internal entropy, they could use a random number server. On boot, they could pull random seed data from a web service like random.org or by hashing Google News headlines.

AretNCarlsen3• 15 years ago

I put up a poll on the subject:

http://news.ycombinator.com/item?id=2597256

JoachimSchipper4• 15 years ago

Why do you feel a poll is useful?

AretNCarlsen3• 15 years ago

I'm coming from a background in massively parallel computing and financial services, both of which are heavy on security. Nonetheless, and even though I have been running cryptographically active instances on Amazon and Rackspace for a long time, I had honestly never thought about the RNG source on VMs.

That is my own failure, of course. I wonder, though, whether everyone else knew about the VM RNG issue, or if only I had missed the memo. If the majority of poll respondents have never thought about the problem at all, perhaps I should start an awareness campaign on wikis and forums.

/dev/random and virtual systems

Related Stories