[ILUG] serious Debian/Ubuntu security hole found

[Michael Watterson]

Timothy Murphy wrote:
> On Wednesday 14 May 2008 10:49:01 am Michael Watterson wrote:
>
>   
>> The only 100% way I know to get a really random number  in a PC is a
>> 3.3V zener diode (white noise generator)  read by a 50 cent PIC A/D
>> converter then read via USB or I2C by the OS, or whatever other A/D
>> converter may be available. I use a zener for filter and frequency
>> response testing from 10Hz to 2GHz. A zener feeding a wideband amplifier
>> with a BNC socket. .
>>     
>
> Why do you think this is "really random"?
>
>   
Because it *IS* noise. The amount but not the character varies with 
temperature. Zero at absolute zero.  Like radioactive half-life where 
you know how many atoms will decay but not which ones in a given time,  
it is a genuinely random signal down to the quantum level. The noise 
voltage can't be predicted at all ever even if you know the temperature.

If you want a really random electronic die this is the way to do it. It 
doesn't mean you won't get 10 sixes in a row (google random walks), but 
you know that chance of a 6 is 1/6th and you can't know form examining 
all the previous throws ever, what the next one will be.

By suitable sampling , conversion and scaling of the Zener Noise you may 
have what ever range of random number you want to have no 
predictability. An ordinary resistor will do the same, but has a much 
smaller signal. Zeners are particularly noisy, so you can easily not be 
influenced by non-random power supply rail noise.  Maybe a  neon tube 
(90v strike,  65V sustain)  might  be noisier, but less convenient and 
I'm not sure.

Any other technique on a PC may not actually be random.


-- 
Mike