Ask HN: Blocking os.urandom calls in Python = 3.6

2 pointsby jbaviatvor 8 Jahren4 comments

In Python 3.6 os.urandom went blocking [1]. As an attacker, how would you destroy the system's entropy to make these calls block (and thus make Python block)? E.g. uuid.uuid4 is now blocking [2].

[1] https://www.python.org/dev/peps/pep-0524/

[2] https://github.com/python/cpython/blob/8b9c33ea9ce902f902c9d9900121010801950547/Lib/uuid.py#L759

1 comments

detarovor 8 Jahren

What do you mean by "destroy the system's entropy"/what attack scenario do you see?

jbaviatvor 8 Jahren

Let's assume I'm using Python 3.6. All my calls to os.urandom (such as uuid.uuid4) can block if my system's entropy goes down. Let's assume as an attacker, I can reduce the system's entropy up to making all calls to e.g. uuid.uuid4 blocking, potentially making my Python blocking everythime.

wahernvor 8 Jahren

IIUC, os.urandom(16) reads the urandom pool using getrandom() without flags. It will only block, if at all, during a short period after boot until the urandom pool is initialized. Thereafter reading from the urandom pool will never block as there's no way to drain it.

detarovor 8 Jahren

No, entropy can't "go down" and cause os.urandom to suddenly start blocking. Once it has returned a value, it will never block.