TWC: Medium: Collaborative: Black-Box Evaluation of Cryptographic Entropy at Scale

TWC：媒介：协作：大规模密码熵的黑盒评估

• 批准号: 1937622
• 负责人: Hovav Shacham
• 金额: $ 7.36万
• 依托单位: University of Texas at Austin
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2018
• 资助国家: 美国
• 起止时间: 2018-09-01 至 2019-09-30
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1937622&HistoricalAwards=false
• 关键词: TWC; Medium; Collaborative; Black; Box

The ability to generate random numbers -- to flip coins -- is crucial for many computing tasks, from Monte Carlo simulation to secure communications. The theory of building such subsystems to generate random numbers is well understood, but the gap between theory and practice is surprisingly wide. As built today, these subsystems are opaque and fragile. Flaws in these subsystems can compromise the security of millions of Internet hosts.This project will develop black-box techniques for finding entropy failures at Internet scale related to randomness. These techniques, which build on programming languages, operating systems, networking, security, and cryptography, will then be applied to perform a systematic, ongoing census of the state of random number generation vulnerabilities. Through this census, the project can analyze the "longtail" of deployed networked systems rather than a handful chosen a priori.The project will develop and disseminate defensive analysis tools that will help programmers debug and correct entropy problems in their code before they ship it. It will produce cryptographic countermeasures and entropy-gathering subsystems that provide better security guarantees than existing systems, reducing the impact of those entropy failures that do slip through.The result will be a better understanding of entropy and more trustworthy systems, today and in the future.

产生随机数的能力--抛硬币--对于许多计算任务来说都是至关重要的，从蒙特卡洛模拟到安全通信。 构建这样的子系统来产生随机数的理论是很好理解的，但理论和实践之间的差距却令人惊讶地大。 今天建成的这些子系统是不透明和脆弱的。 这些子系统中的缺陷可能危及数百万互联网主机的安全。本项目将开发黑盒技术，用于在互联网规模上发现与随机性有关的熵故障。 这些技术建立在编程语言、操作系统、网络、安全和密码学的基础上，然后将被应用于对随机数生成漏洞的状态进行系统的、持续的普查。 通过这次普查，该项目可以分析部署的网络系统的“长尾”，而不是先验选择的少数系统。该项目将开发和推广防御性分析工具，帮助程序员在发布代码之前调试和纠正代码中的熵问题。它将产生密码对策和熵收集子系统，这些子系统提供比现有系统更好的安全保证，减少那些熵失效的影响。其结果将是更好地理解熵和更值得信赖的系统，现在和未来。