Bug #888
Updated by robgar about 10 years ago
I was reading wikipedia.org recently, where I read about a problem with Bob Jenkins ISAAC CSPRNG: In 2006 Jean-Philippe Aumasson discovered several sets of weak states[3]. The fourth presented (and smallest) set of weak states leads to a highly biased output for the first round of ISAAC and allows the derivation of the internal state, similar to a weakness in RC4. It is not clear if an attacker can tell from just the output whether the generator is in one of these weak states or not. He also shows that a previous attack[4] is flawed, since the Paul et al. attack is based on an erroneous algorithm rather than the real ISAAC. An improved version of ISAAC is proposed, called ISAAC+. -- I note that DragonFly is not using ISAAC, but is using IBAA for /dev/random, but I suppose there is a possibility that the same problem exists in IBAA as was found in ISAAC. So I thought I would draw your attention to this - maybe someone should check to see if the problem exists. If it does, I would have thought you could deal with the problem in the same way as RC4; discarding a certain amount of initial output. I note that DragonFly uses L15 for /dev/urandom and I am quite certain that there are no problems there .... Sincerely, R Carey. __________________________________________________________ Sent from Yahoo! Mail - a smarter inbox http://uk.mail.yahoo.com