{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,10,16]],"date-time":"2025-10-16T13:57:04Z","timestamp":1760623024092,"version":"build-2065373602"},"reference-count":21,"publisher":"MDPI AG","issue":"3","license":[{"start":{"date-parts":[[2017,3,13]],"date-time":"2017-03-13T00:00:00Z","timestamp":1489363200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"Next-Generation Information Computing Development Program","award":["NRF-2016M3C4A7030648"],"award-info":[{"award-number":["NRF-2016M3C4A7030648"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Entropy"],"abstract":"<jats:p>Over the past decade, several security issues with Linux Random Number Generator (LRNG) on PCs and Androids have emerged. The main problem involves the process of entropy harvesting, particularly at boot time. An entropy source in the input pool of LRNG is not transferred into the non-blocking output pool if the entropy counter of the input pool is less than 192 bits out of 4098 bits. Because the entropy estimation of LRNG is highly conservative, the process may require more than one minute for starting the transfer. Furthermore, the design principle of the estimation algorithm is not only heuristic but also unclear. Recently, Google released an Internet of Things (IoT) operating system called Brillo based on the Linux kernel. We analyze the behavior of the random number generator in Brillo, which inherits that of LRNG. In the results, we identify two features that enable recovery of random numbers. With these features, we demonstrate that random numbers of 700 bytes at boot time can be recovered with the success probability of 90% by using time complexity for     5.20 \u00d7  2 40      trials. Therefore, the entropy of random numbers of 700 bytes is merely about 43 bits. Since the initial random numbers are supposed to be used for sensitive security parameters, such as stack canary and key derivation, our observation can be applied to practical attacks against cryptosystem.<\/jats:p>","DOI":"10.3390\/e19030113","type":"journal-article","created":{"date-parts":[[2017,3,13]],"date-time":"2017-03-13T10:26:18Z","timestamp":1489400778000},"page":"113","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":9,"title":["Recoverable Random Numbers in an Internet of Things Operating System"],"prefix":"10.3390","volume":"19","author":[{"given":"Taeill","family":"Yoo","sequence":"first","affiliation":[{"name":"Department of Financial Information Security, Kookmin University, Seoul 02707, Korea"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Ju-Sung","family":"Kang","sequence":"additional","affiliation":[{"name":"Department of Financial Information Security, Kookmin University, Seoul 02707, Korea"},{"name":"Department of Mathematics, Kookmin University, Seoul 02707, Korea"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Yongjin","family":"Yeom","sequence":"additional","affiliation":[{"name":"Department of Financial Information Security, Kookmin University, Seoul 02707, Korea"},{"name":"Department of Mathematics, Kookmin University, Seoul 02707, Korea"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"1968","published-online":{"date-parts":[[2017,3,13]]},"reference":[{"key":"ref_1","first-page":"67","article-title":"Randomness and the netscape browser","volume":"10","author":"Goldberg","year":"1996","journal-title":"Dr. Dobb\u2019s J."},{"key":"ref_2","doi-asserted-by":"crossref","unstructured":"Yilek, S., Rescorla, E., Shacham, H., Enright, B., and Savage, S. (2009, January 4\u20136). When private keys are public: Results from the 2008 Debian OpenSSL vulnerability. Proceedings of the 9th ACM SIGCOMM Internet Measurement Conference (IMC 2009), Chicago, IL, USA.","DOI":"10.1145\/1644893.1644896"},{"key":"ref_3","unstructured":"Heninger, N., Durumeric, Z., Wustrow, E., and Halderman, J.A. (2012, January 8\u201310). Mining your ps and qs: Detection of widespread weak keys in network devices. Proceedings of the 21th USENIX Security Symposium, Bellevue, WA, USA."},{"key":"ref_4","doi-asserted-by":"crossref","unstructured":"Bernstein, J.D., Chang, Y., Cheng, C., Chou, L., Heninger, N., Lange, T., and van Someren, N. (2013, January 1\u20135). Factoring RSA keys from certified smart cards: Coppersmith in the wild. Proceedings of the 19th International Conference on the Theory and Application of Cryptology and Information Security, Bengaluru, India.","DOI":"10.1007\/978-3-642-42045-0_18"},{"key":"ref_5","doi-asserted-by":"crossref","unstructured":"Mowery, K., Wei, M., Kohlbrenner, D., Shacham, H., and Swanson, S. (2013, January 19\u201322). Welcome to the entropics: Boot-time entropy in embedded devices. Proceedings of the 2013 IEEE Symposium on Security and Privacy, SP 2013, Berkeley, CA, USA.","DOI":"10.1109\/SP.2013.46"},{"key":"ref_6","doi-asserted-by":"crossref","unstructured":"Ding, Y., Peng, Z., Zhou, Y., and Zhang, C. (2014, January 10\u201314). Android low entropy demystified. Proceedings of the IEEE International Conference on Communications (ICC), Sydney, Australia.","DOI":"10.1109\/ICC.2014.6883394"},{"key":"ref_7","doi-asserted-by":"crossref","unstructured":"Kim, S.H., Han, D., and Lee, D.H. (2013, January 4\u20138). Predictability of Android OpenSSL\u2019s pseudo random number generator. Proceedings of the 2013 ACM SIGSAC Conference on Computer and Communications Security (CCS\u201913), Berlin, Germany.","DOI":"10.1145\/2508859.2516706"},{"key":"ref_8","unstructured":"Kaplan, D., Kedmi, S., Hay, R., and Dayan, A. (2014, January 19). Attacking the linux PRNG on android: Weaknesses in seeding of entropic pools and low boot-time entropy. Proceedings of the 8th USENIX Workshop on Offensive Technologies, San Diego, CA, USA."},{"key":"ref_9","doi-asserted-by":"crossref","unstructured":"Michaelis, K., Meyer, M., and Schwenk, J. (March, January 25). Randomly failed! The state of randomness in current java implementations. Proceedings of the Topics in Cryptology\u2014CT-RSA 2013\u2014The Cryptographers\u2019 Track at the RSA Conference 2013, San Francisco, CA, USA.","DOI":"10.1007\/978-3-642-36095-4_9"},{"key":"ref_10","unstructured":"Bernstein, J.D., Lange, T., and Niederhagen, R. (2016). The New Codebreakers\u2014Essays Dedicated to David Kahn on the Occasion of His 85th Birthday, Springer."},{"key":"ref_11","unstructured":"Checkoway, S., Niederhagen, R., Everspaugh, A., Green, M., Lange, T., Ristenpart, T., Bernstein, J.D., Maskiewicz, J., Shacham, H., and Fredrikson, M. (2014, January 20\u201322). On the practical exploitability of dual EC in TLS implementations. Proceedings of the 23rd USENIX Security Symposium, San Diego, CA, USA."},{"key":"ref_12","doi-asserted-by":"crossref","unstructured":"Gutterman, Z., Pinkas, B., and Reinman, T. (2006, January 21\u201324). Analysis of the linux random number generator. Proceedings of the 2006 IEEE Symposium on Security and Privacy (S&P 2006), Berkeley, CA, USA.","DOI":"10.1109\/SP.2006.5"},{"key":"ref_13","unstructured":"Hay, H., and Dayan, A. Android Keystore Stack Buffer Overflow. Available online: https:\/\/dl.packetstormsecurity.net\/1406-exploits\/android-keystore-stack-buffer-overflow.pdf."},{"key":"ref_14","unstructured":"Google. Available online: https:\/\/android.googlesource.com\/brillo\/manifest\/."},{"key":"ref_15","unstructured":"Lacharme, P., R\u00f6ck, L., Strubel, V., and Videau, M. The linux pseudorandom number generator revisited. Available online: https:\/\/eprint.iacr.org\/2012\/251.pdf."},{"key":"ref_16","unstructured":"Android, Brillo, ChromeOS in Slideshare. (In Japanese)."},{"key":"ref_17","unstructured":"Android Interfaces and Architecture. Available online: https:\/\/source.android.com\/devices\/."},{"key":"ref_18","unstructured":"Intel. Available online: https:\/\/software.intel.com\/en-us\/iot\/hardware\/edison."},{"key":"ref_19","unstructured":"Brillo OS\u2014Successfully Flashing. Available online: https:\/\/communities.intel.com\/thread\/96539."},{"key":"ref_20","doi-asserted-by":"crossref","unstructured":"Grimmett, G.R., and Stirzaker, D.R. (2001). Probability and Random Processes, Oxford University Press. [3rd ed.].","DOI":"10.1093\/oso\/9780198572237.001.0001"},{"key":"ref_21","unstructured":"Mathworks, Version R2016b. Available online: https:\/\/kr.mathworks.com\/help\/stats\/model-data-using-the-distribution-fitting-tool.html."}],"container-title":["Entropy"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1099-4300\/19\/3\/113\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,11]],"date-time":"2025-10-11T18:30:20Z","timestamp":1760207420000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1099-4300\/19\/3\/113"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2017,3,13]]},"references-count":21,"journal-issue":{"issue":"3","published-online":{"date-parts":[[2017,3]]}},"alternative-id":["e19030113"],"URL":"https:\/\/doi.org\/10.3390\/e19030113","relation":{},"ISSN":["1099-4300"],"issn-type":[{"type":"electronic","value":"1099-4300"}],"subject":[],"published":{"date-parts":[[2017,3,13]]}}}