Test before hashed/ whitened: yes. That was my original thought. But as others pointed out, that's not the same thing as what the whole process outputs.
Also as per your comment with HWW, isn't it su...
> Test before hashed/ whitened: yes. That was my original thought. But as others pointed out, that's not the same thing as what the whole process outputs.
Sure, but screwing up XORing three validated chunks together is harder than screwing up one. It wouldn’t have saved this case (which was ultimately a failure of having an insecure fallback in the code at all, which shouldn’t be allowed!), but it should be common practice.
> Also as per your comment with HWW, isn't it super-hard/impossible to check the *input* to dev/urandom's CSPRNG, in practice?
On Linux? Sure, that’s ultimately because it’s post-whitened/hashed which makes it hard to validate. That doesn’t mean it couldn’t be XOR’d with more but probably we should be requiring at least one “validated” input to any RNG for key generation.
Sure, but screwing up XORing three validated chunks together is harder than screwing up one. It wouldn’t have saved this case (which was ultimately a failure of having an insecure fallback in the code at all, which shouldn’t be allowed!), but it should be common practice.
> Also as per your comment with HWW, isn't it super-hard/impossible to check the *input* to dev/urandom's CSPRNG, in practice?
On Linux? Sure, that’s ultimately because it’s post-whitened/hashed which makes it hard to validate. That doesn’t mean it couldn’t be XOR’d with more but probably we should be requiring at least one “validated” input to any RNG for key generation.