论文标题
固件内部人士：蓝牙随机性主要是随机的
Firmware Insider: Bluetooth Randomness is Mostly Random
论文作者
论文摘要
蓝牙芯片必须包括一个随机数发生器（RNG）。该RNG内部用于加密原始图中，但也暴露于芯片外部应用程序的操作系统。通常，它是一个黑匣子，具有关键性身份验证和加密机制。在本文中，我们评估了各种Broadcom和Cypress蓝牙芯片中RNG的质量。我们发现，在过去十年中，RNG实施发生了重大变化。此外，大多数设备实现了不安全的伪随机数生成器（PRNG）后备。由于缺少硬件随机数生成器（HRNG），因此多个流行的设备，例如三星Galaxy S8及其变体以及iPhone，依赖于弱后备。我们统计评估了数亿个设备使用的芯片中各种HRNG的产出。尽管Broadcom和Cypress HRNG通过高级测试，但如果蓝牙芯片在没有本文中的广泛分析的情况下实现安全的RNG，则用户仍然无法区分。我们描述我们的测量方法并发布我们的工具以实现进一步的公共测试。
Bluetooth chips must include a Random Number Generator (RNG). This RNG is used internally within cryptographic primitives but also exposed to the operating system for chip-external applications. In general, it is a black box with security-critical authentication and encryption mechanisms depending on it. In this paper, we evaluate the quality of RNGs in various Broadcom and Cypress Bluetooth chips. We find that the RNG implementation significantly changed over the last decade. Moreover, most devices implement an insecure Pseudo-Random Number Generator (PRNG) fallback. Multiple popular devices, such as the Samsung Galaxy S8 and its variants as well as an iPhone, rely on the weak fallback due to missing a Hardware Random Number Generator (HRNG). We statistically evaluate the output of various HRNGs in chips used by hundreds of millions of devices. While the Broadcom and Cypress HRNGs pass advanced tests, it remains indistinguishable for users if a Bluetooth chip implements a secure RNG without an extensive analysis as in this paper. We describe our measurement methods and publish our tools to enable further public testing.
