#102 Weak entropy source used for key generation

[Alexander Mette]

xca apparantly uses /dev/urandom for entropy when creating keys, which is of lower quality than /dev/random. This is quite a bad thing for a software like this. Searching the web uncovered that Debian people verified this problem: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=706539

/dev/random should be used by default and for people that don't need high quality certificates, there could be an option to select /dev/urandom.

[henrik]

xca apparently does open both random and urandom now (commit c1931f)

open("/home/user/.xca/.rnd", O_RDWR|O_CREAT|O_CLOEXEC, 0666) = 9
open("/dev/random", O_RDONLY|O_NONBLOCK) = 10
open("/dev/hwrng", O_RDONLY|O_NONBLOCK) = -1 ENOENT (No such file or directory)
open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK) = 10
open("/proc/stat", O_RDONLY|O_CLOEXEC)  = 6

It still is somewhat opaque to the user where the randomness of his key comes from and how strong it is.

I would suggest to make the function that provides randomness somewhat more transparent to the user. A little bit of Security Theater can't hurt (if it is honest theater). ;-)

I imagine something that in "etreme paranoia mode" only reads from /dev/random directly, without a pseudo rng and if there isn't enough entropy will pop up a window that will show the amount of entropy still needed. Something like a simple completion bar.
That window should also have some gui elements to allow the user to type and click as long as is needed to replenish the entropy pool.

Tools like truecrypt let you see the random bits they read and you get immediate feedback when you move the mouse around or hit the keyboard.

Judging from the speed at which truecrypt randomness scrolls by, it is clear that they also use a prng but it makes for a very good show!

I found some details on the entropy needed and the use of random/urandom here:
http://security.stackexchange.com/questions/53471/how-much-time-entropy-collected-should-generating-a-rsa-2048bit-keypair-take

There is also a very nice write up on the kernel architecture and use of /dev/random and /dev/urandom here: http://www.2uo.de/myths-about-urandom/

It does say in the end that you might use /dev/random for your long lived keys.
So we are back to making this an option, right?

Sorry about the lengthy comment.

[Christian Hohnstaedt]

commit 1138dad902459cb0f29ca80c70c47597c427e023
Author: Christian Hohnstaedt christian@hohnstaedt.de
Date: Mon Apr 6 10:50:31 2015 +0200

SF Bug #102 Weak entropy source used for key generation

On startup use "/dev/random" and "/dev/hwrng"
as additional entropy for the OpenSSL random pool.

Collect mouse position and key press time entropy
for seeding the openssl random pool before generating keys.

When using Smartcards, use the Smartcard RNG
as additional entropy source.