RE: [Caml-list] Re: [oss-security] CVE request: Hash DoS vulnerability (ocert-2011-003)

[David Allsopp <dra-news@metastack.com>]

Dario Teixeira wrote:
> Hi,
> 
> > Basically I like the idea of "teaching" users this way. The typical
> > user
> 
> > will understand the impact, and act accordingly. Nevertheless, I would
> > like it if it would be made as easy as possible to provide good seeds
> > if required. The Random module is definitely not good enough (e.g. if
> > you know when the program was started like for a cgi, and the cgi
> > reveals information it should better not like the pid, the Random seed
> > is made from less than 10 unpredictable bits, and on some systems even
> 0 bits).
> >
> > The ideal would be to guide the user to the decision whether
> > protection is necessary, and if the answer is yes, to give the
> > instructions how to do it (and provide all means for it, of course).
> 
> I think the problem may be in finding a good source of randomness that is
> common across all OSes.  In Unixland this problem has largely been
> solved:
> pretty much everyone supports /dev/random and /dev/urandom.  Windows does
> things differently, however.

Does the source of randomness have to be common? The decision to use a random seed doesn't need to be limited by a problem getting a good cryptographically secure generator on a given OS - you'd simply document that the implementation on that particular OS doesn't seed with a good PRNG and await a patch from someone who may care in the future, but at least the philosophy behind the decision is correct!

On Windows, as it happens, the situation is relatively easy (and it's not as even the Windows ports don't already have 1001 other workarounds and alternate methods in the runtime and standard library!): CryptGenRandom in the Crypto API or a neat little trick described in http://blogs.msdn.com/b/michael_howard/archive/2005/01/14/353379.aspx.


David