summaryrefslogtreecommitdiff
path: root/lib/Crypto/Random
Commit message (Collapse)AuthorAgeFilesLines
* Merge tag 'v2.6.1' (fix CVE-2013-1445)Dwayne Litzenberger2013-10-202-2/+43
|\ | | | | | | | | | | | | | | | | | | This is the PyCrypto 2.6.1 release. Dwayne Litzenberger (4): Random: Make Crypto.Random.atfork() set last_reseed=None (CVE-2013-1445) Fortuna: Add comments for reseed_interval and min_pool_size to FortunaAccumulator Update the ChangeLog Release v2.6.1
| * Fortuna: Add comments for reseed_interval and min_pool_size to ↵Dwayne Litzenberger2013-10-141-2/+19
| | | | | | | | FortunaAccumulator
| * Random: Make Crypto.Random.atfork() set last_reseed=None (CVE-2013-1445)Dwayne Litzenberger2013-10-142-0/+24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | == Summary == In PyCrypto before v2.6.1, the Crypto.Random pseudo-random number generator (PRNG) exhibits a race condition that may cause it to generate the same 'random' output in multiple processes that are forked from each other. Depending on the application, this could reveal sensitive information or cryptographic keys to remote attackers. An application may be affected if, within 100 milliseconds, it performs the following steps (which may be summarized as "read-fork-read-read"): 1. Read from the Crypto.Random PRNG, causing an internal reseed; 2. Fork the process and invoke Crypto.Random.atfork() in the child; 3. Read from the Crypto.Random PRNG again, in at least two different processes (parent and child, or multiple children). Only applications that invoke Crypto.Random.atfork() and perform the above steps are affected by this issue. Other applications are unaffected. Note: Some PyCrypto functions, such as key generation and PKCS#1-related functions, implicitly read from the Crypto.Random PRNG. == Technical details == Crypto.Random uses Fortuna[1] to generate random numbers. The flow of entropy looks something like this: /dev/urandom -\ +-> "accumulator" --> "generator" --> output other sources -/ (entropy pools) (AES-CTR) - The "accumulator" maintains several pools that collect entropy from the environment. - The "generator" is a deterministic PRNG that is reseeded by the accumulator. Reseeding normally occurs during each request for random numbers, but never more than once every 100 ms (the "minimum reseed interval"). When a process is forked, the parent's state is duplicated in the child. In order to continue using the PRNG, the child process must invoke Crypto.Random.atfork(), which collects new entropy from /dev/urandom and adds it to the accumulator. When new PRNG output is subsequently requested, some of the new entropy in the accumulator is used to reseed the generator, causing the output of the child to diverge from its parent. However, in previous versions of PyCrypto, Crypto.Random.atfork() did not explicitly reset the child's rate-limiter, so if the child requested PRNG output before the minimum reseed interval of 100 ms had elapsed, it would generate its output using state inherited from its parent. This created a race condition between the parent process and its forked children that could cause them to produce identical PRNG output for the duration of the 100 ms minimum reseed interval. == Demonstration == Here is some sample code that illustrates the problem: from binascii import hexlify import multiprocessing, pprint, time import Crypto.Random def task_main(arg): a = Crypto.Random.get_random_bytes(8) time.sleep(0.1) b = Crypto.Random.get_random_bytes(8) rdy, ack = arg rdy.set() ack.wait() return "%s,%s" % (hexlify(a).decode(), hexlify(b).decode()) n_procs = 4 manager = multiprocessing.Manager() rdys = [manager.Event() for i in range(n_procs)] acks = [manager.Event() for i in range(n_procs)] Crypto.Random.get_random_bytes(1) pool = multiprocessing.Pool(processes=n_procs, initializer=Crypto.Random.atfork) res_async = pool.map_async(task_main, zip(rdys, acks)) pool.close() [rdy.wait() for rdy in rdys] [ack.set() for ack in acks] res = res_async.get() pprint.pprint(sorted(res)) pool.join() The output should be random, but it looked like this: ['c607803ae01aa8c0,2e4de6457a304b34', 'c607803ae01aa8c0,af80d08942b4c987', 'c607803ae01aa8c0,b0e4c0853de927c4', 'c607803ae01aa8c0,f0362585b3fceba4'] == Solution == The solution is to upgrade to PyCrypto v2.6.1 or later, which properly resets the rate-limiter when Crypto.Random.atfork() is invoked in the child. == References == [1] N. Ferguson and B. Schneier, _Practical Cryptography_, Indianapolis: Wiley, 2003, pp. 155-184.
* | Fix error importing winrandom on Python 3Jason R. Coombs2013-05-251-1/+1
| | | | | | On Python 3, 'import winrandom' cannot be automatically converted to the relative import, so fails. This change fixes that behavior.
* | FortunaAccumulator: Use time.monotonic if available (i.e. Python 3.3 and later)Dwayne Litzenberger2013-04-211-2/+5
| |
* | Fix dumb typo: "is 2" should be "== 2"Dwayne Litzenberger2013-02-171-1/+1
| |
* | Fix LP#1061217: random.shuffle takes O(n^2) timeDwayne Litzenberger2013-02-161-7/+7
|/ | | | | | | | | | | The previous implementation took O(n**2) time and O(n) auxiliary space. We now use the Fisher-Yates algorithm, which takes O(n) time and O(1) space. Thanks to Sujay Jayakar and Andrew Cooke for pointing this out and suggesting a solution. Bug report: https://bugs.launchpad.net/pycrypto/+bug/1061217
* Fix DevURandomRNG to work with Python3's new I/O stack.Sebastian Ramacher2012-04-211-2/+25
|
* Merge from upstreamLegrandin2011-12-221-2/+2
|\
| * Python 3.x fixes:Dwayne C. Litzenberger2011-10-221-2/+2
| | | | | | | | | | - Use absolute imports - Fix StringIO import so that 2to3 can translate it
* | Merged from upstream (py3k support) and modified so that all unit tests pass.Legrandin2011-10-186-24/+45
|\ \ | |/
| * Fix AllOrNothing and random.sample()Thorsten Behrens2011-01-061-1/+1
| | | | | | | | | | | | o AllOrNothing no longer fails occasionally. Patch by Lorenz Quack o random.sample() works on Python 2.1. Patch by Paul Koning and Lorenz Quack
| * Improve random selftestThorsten Behrens2011-01-051-3/+1
| | | | | | | | | | o Random selftest is improved, less likely to collide o random.shuffle() is more pythonic
| * Add unit tests for Crypto.Random.randomThorsten Behrens2010-12-311-3/+3
| | | | | | | | | | | | o Add unit tests o Fix random.shuffle() o random.sample() does not work on 2.1. This has not been fixed.
| * PY3K _fastmath supportThorsten Behrens2010-12-295-8/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | o _fastmath now builds and runs on PY3K o Changes to setup.py to allow /usr/include for gmp.h o Changes to setup.py to allow linking fastmath w/ static mpir on Windows without warning messages o Changes to test_DSA/test_RSA to throw an exception if _fastmath is present but cannot be imported (due to an issue building _fastmath or the shared gmp/mpir libraries not being reachable) o number.py has the code to flag a failing _fastmath, but that code is commented out for a better runtime experience o Clean up the if for py21compat import - should have been == not is o Clean up some '== None' occurences, now 'is None' instead
| * Changes to allow pycrpyto to work on Python 3.x as well as 2.1 through 2.7Thorsten Behrens2010-12-286-20/+44
| |
* | Add new() method to all remaining hash algorithms, so as to make them to ↵Legrandin2011-02-071-1/+3
|/ | | | work with PKCS#1 PSS. Add also test cases for it for every hash.
* Random: Improve the comment attached to _UserFriendlyRNG#_check_pidDwayne C. Litzenberger2009-08-281-1/+9
|
* Random: Add Crypto.Random.get_random_bytes()Dwayne C. Litzenberger2009-08-282-0/+8
| | | | | | | | | | | | | This should allow people to use something like this if they want backwards-compatibility: try: from Crypto.Random import get_random_bytes except ImportError: try: from os import urandom as get_random_bytes except ImportError: get_random_bytes = open("/dev/urandom", "rb").read
* Random: Remove RandomPoolCompatDwayne C. Litzenberger2009-08-281-53/+1
| | | | | | | | | | | | | | RandomPoolCompat seems to give people the wrong idea that it's okay to use RandomPool if Crypto.Random is not available. try: from Crypto.Random import RandomPoolCompat as RandomPool except ImportError: from Crypto.Util.randpool import RandomPool In order to discourage all use of RandomPool, I'm getting rid of RandomPoolCompat. Instead, Crypto.Util.randpool.RandomPool will be a wrapper around Crypto.Random that emits a DeprecationWarning.
* Legal: Dedicate my files to the public domain.Dwayne C. Litzenberger2009-03-0111-220/+190
| | | | | | | | | | | | | In an attempt to simplify the copyright status of PyCrypto, I'm placing my code into the public domain, and encouraging other contributors to do the same. I have used a public domain dedication that was recommended in a book on FOSS legal issues[1], followed by the warranty disclaimer boilerplate from the MIT license. [1] _Intellectual Property and Open Source: A Practical Guide to Protecting Code_, a book written by Van Lindberg and published by O'Reilly Media. (ISBN 978-0-596-51796-0)
* cleanup: Move modules to "lib/Crypto" subdirectory.Dwayne C. Litzenberger2009-02-2812-0/+1129
This will avoid the previous situation where scripts like the old "test.py" get included accidentally in a release. It also frees us to put additional build scripts in the top-level directory of the source tree.
View Lorry Controller Status