On Tue, 04 Oct 2005 15:08:40 +0200, Simon Josefsson said: > â?¢ The process ID of the current process requesting random data > â?¢ The thread ID of the current thread within the process requesting > random data > â?¢ A 32bit tick count since the system boot > â?¢ The current local date and time > â?¢ The current system time of day information consisting of the boot > time, c urrent time, time zone > ... > plus many more sources. > > I wonder if anybody has quantified the amount of entropy that could > realistically be extracted from the mentioned sources. Umm.. "not much". ;) For instance, note that there's "32 bit tick count" and "current time". Wandering over to Netcraft will give you the uptime - and how many times do they fold "current time" in there? Each additional one adds exactly zero entropy. Similarly, you get 4.5 bits of entropy *MAX* from 'time zone' - and if you can guess where the box is down to the continent, you're down to 2-3 tops, and possibly exactly 0 if you know the city.... Similarly, if "process ID" and "thread ID" are sequentially allocated integers, there's probably only 3-4 bits of entropy in the process ID (since at each reboot, everything starts in the same order each time)
Attachment:
pgph6xAZmiUCN.pgp
Description: PGP signature
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/