Bug #888

Updated by robgar over 2 years ago

I was reading wikipedia.org recently, where I read

about a problem with Bob Jenkins ISAAC CSPRNG:

In 2006 Jean-Philippe Aumasson discovered several sets

of weak states[3]. The fourth presented (and smallest)

set of weak states leads to a highly biased output for

the first round of ISAAC and allows the derivation of

the internal state, similar to a weakness in RC4. It

is not clear if an attacker can tell from just the

output whether the generator is in one of these weak

states or not. He also shows that a previous attack[4]

is flawed, since the Paul et al. attack is based on an

erroneous algorithm rather than the real ISAAC. An

improved version of ISAAC is proposed, called ISAAC+.


I note that DragonFly is not using ISAAC, but is using

IBAA for /dev/random, but I suppose there is a

possibility that the same problem exists in IBAA as

was found in ISAAC.

So I thought I would draw your attention to this -

maybe someone should check to see if the problem

exists. If it does, I would have thought you could

deal with the problem in the same way as RC4;

discarding a certain amount of initial output.

I note that DragonFly uses L15 for /dev/urandom and I

am quite certain that there are no problems there ....


R Carey.


Sent from Yahoo! Mail - a smarter inbox http://uk.mail.yahoo.com