Rasp Pi Generates Weak SSH Keys

Dec 02, 2015

The Pi's popular Raspbian OS pursues secrecy without entropy.

The Debian-based Raspbian Linux system, which runs on the tiny and popular Raspberry Pi single-board computer systems, appears to have a problem generating potentially weak SSH keys. Because the Rasp Pi doesn't come with a monitor, many Pi owners use SSH as a primary means of communicating with the system. And although a majority of the consumer-end Pis are sitting behind firewalls on little home networks (uh, how safe are those little home firewalls?), Internet-connected Raspberry Pis have started to appear as web servers, weather stations, remote photography experiments, and security cameras.

The Register quotes a Rasp Pi message board note, “Many Linux distributions stockpile random seed data during installation, and then use that to prime the pool during first boot-up, but Raspbian doesn't work that way – it starts up ready to go straight from the SD card, and thus suffers from low entropy.”

On current Raspbian systems, hardware random number generation isn't enabled by default. The system uses the random data in the /dev/urandom pool to generate a host key, but the pool doesn't have enough entropy at the early stage where the keys are created.

The Raspbian developers say they will fix the issue in the next release. In the meantime, users who are concerned about SSH security should use the Pi's onboard hardware random number generator to see the /dev/urandom file and regenerate SSH host keys.

Related content

  • NEWS

    Updates on technologies, trends, and tools

  • Charly’s Column: haveged

    Practical cryptography is often an encounter with many random numbers in just a few moments. Entropy is the raw material that gives birth to the random number, but it’s harder to come by than you might think.

  • Linus Says No Backdoor in Linux

    Brief dust-up in the kernel community leads to an illuminating look at random number generation.

  • KeePassX

    KeePassX is an open source personal data management tool that lets you keep your passwords, URLs, attachments, and peace of mind

  • Kernel News

    Chronicler Zack Brown reports on the latest news, views, dilemmas, and developments within the Linux kernel community.

comments powered by Disqus
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters

Support Our Work

Linux Magazine content is made possible with support from readers like you. Please consider contributing when you’ve found an article to be beneficial.

Learn More

News