Rasp Pi Generates Weak SSH Keys

Dec 02, 2015

The Pi's popular Raspbian OS pursues secrecy without entropy.

The Debian-based Raspbian Linux system, which runs on the tiny and popular Raspberry Pi single-board computer systems, appears to have a problem generating potentially weak SSH keys. Because the Rasp Pi doesn't come with a monitor, many Pi owners use SSH as a primary means of communicating with the system. And although a majority of the consumer-end Pis are sitting behind firewalls on little home networks (uh, how safe are those little home firewalls?), Internet-connected Raspberry Pis have started to appear as web servers, weather stations, remote photography experiments, and security cameras.

The Register quotes a Rasp Pi message board note, “Many Linux distributions stockpile random seed data during installation, and then use that to prime the pool during first boot-up, but Raspbian doesn't work that way – it starts up ready to go straight from the SD card, and thus suffers from low entropy.”

On current Raspbian systems, hardware random number generation isn't enabled by default. The system uses the random data in the /dev/urandom pool to generate a host key, but the pool doesn't have enough entropy at the early stage where the keys are created.

The Raspbian developers say they will fix the issue in the next release. In the meantime, users who are concerned about SSH security should use the Pi's onboard hardware random number generator to see the /dev/urandom file and regenerate SSH host keys.

Related content

  • NEWS

    Updates on technologies, trends, and tools

  • Charly’s Column: haveged

    Practical cryptography is often an encounter with many random numbers in just a few moments. Entropy is the raw material that gives birth to the random number, but it’s harder to come by than you might think.

  • Linus Says No Backdoor in Linux

    Brief dust-up in the kernel community leads to an illuminating look at random number generation.

  • KeePassX

    KeePassX is an open source personal data management tool that lets you keep your passwords, URLs, attachments, and peace of mind

  • Deleting Data

    Backups are a common topic, but you’ll hardly hear anyone mention safe data deletion.

comments powered by Disqus

Issue 206/2018

Buy this issue as a PDF

Digital Issue: Price $9.99
(incl. VAT)

News

njobs Europe
What:
Where:
Country:
Njobs Netherlands Njobs Deutschland Njobs United Kingdom Njobs Italia Njobs France Njobs Espana Njobs Poland
Njobs Austria Njobs Denmark Njobs Belgium Njobs Czech Republic Njobs Mexico Njobs India Njobs Colombia