[ILUG] serious Debian/Ubuntu security hole found

[Michael Watterson]

Justin Kelly wrote:
>  | Date: Wed, 14 May 2008 10:49:01 +0100
> | From: Michael Watterson <watty at eircom.net>
> |[ ... ]
> | The only 100% way I know to get a really random number in
> | a PC is a 3.3V zener diode (white noise generator) [ ... ]
>
> Simpler solution:
>
> (Almost) every pc today comes with a sound card. Why not get a cheap
> microphone (in this case the cheaper the better), plug it in and sample
> /dev/sound each time. For best effect, bolt it to the plumbing if you are in a
> big building. Every time a toilet flushes, you have a big burst of randomness.
> Alternatively, if you don't like the idea of being snooped on, use a cheap
> radio, tuned to some spot between the channels with plenty of noise.
>
> I'm a bit old to be soldering zener diodes :)
>
> JK
>
>
>   
Really my point is that by 1950s it was well known a computer could not 
do random numbers.
In the 1970's the Zener approach was suggested as something to be to be 
built in to every computer, but the required ADC was about £5.  At  
this  stage  if it was part of the Mobo Spec it would add about 35cents 
to the cost, if that. The Zener itself is about 4 cents. So if there is 
a spare ADC pin on any SOC (or sound card channel intended for analogue 
Modem) the cost is under 10 cents.

I know it's not the central issue with the OpenSSL. But some of us have 
been saying for 30 years this would be really nice to have. Better than 
a  pair of  casino  clear  dice.



-- 
Mike