Exploiting Randomness: Fun Attacks Using a Compromised Random Number Generator

Presented at Summercon 2014, June 5, 2014, 11 a.m. (50 minutes).

Many information security systems rely on cryptographic schemes that need truly random numbers be secure. In recent months there have been several high profile news stories about weaknesses or potential compromises in both software and hardware random number generators. A compromised random number generator is difficult to catch because it can output random looking data that is predictable to an attacker only. In this talk I describe how to go from knowledge of a weakness in a random number generator to a full security compromise. We will look at examples including how to fully decrypt a TLS stream, how to compromise a bitcoin wallet by looking at the ECDSA signatures on the public block chain, how to factor improperly generated RSA keys, and more. There will be live demos and discussions of interesting ways to pull off these attacks.


Presenters:

  • Nick Sullivan
    Nick leads the security engineering team at CloudFlare where he is working to build a better and more secure Internet. He is a respected security expert and digital rights management pioneer, having built many of the content security mechanisms forv Apple's multi-billion dollar iTunes store. He previously worked as a security analyst worked at Symantec analyzing large scale threat data. He holds an MSc in Cryptography and a BMath in Pure Mathematics and is the author of over a dozen computer security patents.

Links:

Similar Presentations: