|
OpenSSL's PRNG (located in crypto/md_rand.c in the source) uses a hash function to update its internal secret state and to generate output. The default hash selected is SHA-1. The PRNG's internal secret state contains two variables, a chaining variable called "md", sized according to the output of the selected hash function, and a large buffer called "state". The contents of "md" are replaced by a hash function output. "state" is accessed in a circular fashion, and is used for storing additional bits of entropy.
The vulnerable versions of OpenSSL set "md" to the hash of one half of its previous value and other data, including bytes from "state". Unfortunately, in vulnerable versions, the half of "md" input passed to the hash function is the same half that's used as PRNG output. Also, the number of bytes used from "state" can be as small as one if the requested amount of PRNG output is small. This makes brute-force analysis of all possible cases easy. The combination of these effects made it possible to reconstruct the complete internal PRNG state from the output of one PRNG request appropriately sized to your hash function (to gain knowledge of "md") followed by enough consecutive 1-byte PRNG requests to traverse all of "state".
|
nokia.com -
