Comment by tptacek
5 days ago
Can you link to the paper you're thinking of? Maybe people are just talking past each other here. A biased random source can't bias the kernel random pool in any straightforward kind of way.
5 days ago
Can you link to the paper you're thinking of? Maybe people are just talking past each other here. A biased random source can't bias the kernel random pool in any straightforward kind of way.
I explicitly said
because the malicious source can just precompute the hash for the bias it wants.
https://blog.cr.yp.to/20140205-entropy.html
You're assuming a hash preimage attack, which would be a complete break of the cryptosystem. (Your link only works on the toy implementation given.)
there is no preimage attack involved.
while you cannot take control over the hash output you can bias it because you have multiple tries. that's how bitcoin mining works too...
for cryptographic applications any bias can be engineered to be fatal in one way or another.