tillitis/tkey-ssh-agent

The random app should not return TRNG entropy

Closed this issue · 2 comments

secworks commented

The get_random function returns entropy from the TRNG core. It should instead use a secure Digital Random Bit Generator (DRBG) such as a Hash_DRBG or CTR_DRBG.

https://github.com/tillitis/tillitis-key1-apps/blob/dfb113101be19d7acdd544a4759b85aa8129e2d5/apps/random/main.c#L26

quite commented

In js words, we can develop the randomapp further like:

  1. Add the same Hash_DRBG I have in the RNG stream
  2. Add Ed25519 signing of generated data. Possibly also accept a challenge with the get random command from the host
secworks commented

I think that sounds like a great improvement. Go for it!