question about RtlGenRandom (SystemFunction036) and urandom

Hello, I just randomly stumbled upon this old mail
http://www.winehq.org/pipermail/wine-patches/2005-May/017718.html
and I found the FIXME comment about (lack of) cryptographic quality 
slightly worrying, so I had a quick look at the gitweb to see 
what the implementation would look like these days. Apparently 
this method still uses urandom but the FIXME comment has 
been removed (in 
http://source.winehq.org/git/wine.git/?a=commitdiff;h=59f2a3312e4c16876b69f9... )

Just thought I'd give it a heads-up, maybe this is still an issue
that should at least be marked in the comments?

[Juan Lang]

> Just thought I'd give it a heads-up, maybe this is still an issue
> that should at least be marked in the comments?

I removed that comment because it's too strong.  We have no idea what
guarantees of randomness RtlGenRandom provides, so it's not clear
there's anything to fix.

Feel free to send a patch.
--Juan

On Wed, Jul 15, 2009 at 08:23:06 -0700, Juan Lang wrote:
> > Just thought I'd give it a heads-up, maybe this is still an issue
> > that should at least be marked in the comments?
>
> I removed that comment because it's too strong.  We have no idea what
> guarantees of randomness RtlGenRandom provides, so it's not clear
> there's anything to fix.

Thanks for the quick response! Actually it seems that rand_s()
uses RtlGenRandom[2], and MSDN claims the function can be used for
cryptographically secure random numbers[1]. This is something I noticed
by following the discussion about Firefox 3.5's slow startup times on
Windows that RtlGenRandom seems to be used for just this purpose, or 
at least that's the impression I got after quickly reading through this:
https://bugzilla.mozilla.org/show_bug.cgi?id=501605#c135

If win32 apps rely on this method for security, I figured maybe this 
would be reason enough to at least keep the FIXME in there (slightly
worried about similarities to Debian's OpenSSL incident, although that
was much more severe).

I'm not really a wine hacker so this may all be a false alarm, though
I thought it would be best to at least mention this, was all.

References: 
  [1] rand_s(): 
    http://msdn.microsoft.com/en-us/library/sxtz2fa8%28VS.80%29.aspx
  [2] its use of RtlGenRandom: 
    http://blogs.msdn.com/michael_howard/archive/2005/01/14/353379.aspx

[Juan Lang]

> Thanks for the quick response! Actually it seems that rand_s()
> uses RtlGenRandom[2], and MSDN claims the function can be used for
> cryptographically secure random numbers[1].

I don't see anything on that page that says that it can be used for
cryptographically secure random numbers, not that we've defined that
term.  I do see that it generates pseudorandom numbers, which
/dev/urandom does as well, and rand() notably does not.
> If win32 apps rely on this method for security, I figured maybe this
> would be reason enough to at least keep the FIXME in there (slightly
> worried about similarities to Debian's OpenSSL incident, although that
> was much more severe).

This is different.  Our RtlGenRandom generates pseudorandom numbers as
well as /dev/urandom does.  How random that is depends on the kernel
you're running and how large the entropy pool is when we call into it.
>  [2] its use of RtlGenRandom:
>    http://blogs.msdn.com/michael_howard/archive/2005/01/14/353379.aspx

You didn't reference this, but I'll comment on it anyway:  The main
point of this is that it's possible to get pseudorandom numbers using
RtlGenRandom, and doing so doesn't require that you load crypt32.
crypt32 is fairly large, so if all you want is a pseudorandom number,
and nothing else to do with the Win32 crypto API, there's a less
expensive way to get one.  How strong that pseudorandom number is is
unknown.
--Juan