2.23. Add Section 8.5 - Entropy of Random Numbers, Key Pairs, and Shared Secret Information
2.23. Add Section 8.5 - Entropy of Random Numbers, Key Pairs, and Shared Secret Information
The following subsection addresses the risk arising from low entropy of random numbers, asymmetric keys, and shared secret information.
Insert this section after the new Section 8.4:
8.5. Entropy of Random Numbers, Key Pairs, and Shared Secret Information
Implementations must generate nonces and private keys from random input. The use of inadequate pseudorandom number generators (PRNGs) to generate cryptographic keys can result in little or no security. An attacker may find it much easier to reproduce the PRNG environment that produced the keys and to search the resulting small set of possibilities than brute-force searching the whole key space. As an example of predictable random numbers, see [CVE-2008-0166]; consequences of low-entropy random numbers are discussed in Mining Your Ps and Qs [MiningPsQs]. The generation of quality random numbers is difficult. ISO/IEC 20543:2019 [ISO.20543-2019], NIST SP 800-90A Rev.1 [NIST_SP_800_90Ar1], BSI AIS 31 V2.0 [AIS31], and other specifications offer valuable guidance in this area.
If shared secret information is generated by a cryptographically secure random number generator (CSRNG), it is safe to assume that the entropy of the shared secret information equals its bit length. If no CSRNG is used, the entropy of shared secret information depends on the details of the generation process and cannot be measured securely after it has been generated. If user-generated passwords are used as shared secret information, their entropy cannot be measured and are typically insufficient for protected delivery of centrally generated keys or trust anchors.
If the entropy of shared secret information protecting the delivery of a centrally generated key pair is known, it should not be less than the security strength of that key pair; if the shared secret information is reused for different key pairs, the security of the shared secret information should exceed the security strength of each individual key pair.
For the case of a PKI management operation that delivers a new trust anchor (e.g., a root CA certificate) using caPubs or genm that is (a) not concluded in a timely manner or (b) where the shared secret information is reused for several key management operations, the entropy of the shared secret information, if known, should not be less than the security strength of the trust anchor being managed by the operation. The shared secret information should have an entropy that at least matches the security strength of the key material being managed by the operation. Certain use cases may require shared secret information that may be of a low security strength, e.g., a human-generated password. It is RECOMMENDED that such secret information be limited to a single PKI management operation.