149149 <seriesInfo name =' DOI' value =' 10.17487/RFC1207' />
150150 </reference >
151151 </references >
152+ <references title =" Malformed Normative References" >
153+ <!-- title attribute was for references title was removed for v3, but should be recognized -->
154+ <reference anchor =' RFC4086' target =' https://www.rfc-editor.org/info/rfc4086' >
155+ <front >
156+ <title >Randomness Requirements for Security</title >
157+ <author initials =' D.' surname =' Eastlake 3rd' fullname =' D. Eastlake 3rd' >
158+ <organization />
159+ </author >
160+ <author initials =' J.' surname =' Schiller' fullname =' J. Schiller' >
161+ <organization />
162+ </author >
163+ <author initials =' S.' surname =' Crocker' fullname =' S. Crocker' >
164+ <organization />
165+ </author >
166+ <date year =' 2005' month =' June' />
167+ <abstract >
168+ <t >Security systems are built on strong cryptographic algorithms that foil pattern analysis
169+ attempts. However, the security of these systems is dependent on generating secret
170+ quantities for passwords, cryptographic keys, and similar quantities. The use of
171+ pseudo-random processes to generate secret quantities can result in pseudo-security. A
172+ sophisticated attacker may find it easier to reproduce the environment that produced the
173+ secret quantities and to search the resulting small set of possibilities than to locate the
174+ quantities in the whole of the potential number space.
175+ </t >
176+ <t >Choosing random quantities to foil a resourceful and motivated adversary is surprisingly
177+ difficult. This document points out many pitfalls in using poor entropy sources or
178+ traditional pseudo-random number generation techniques for generating such quantities. It
179+ recommends the use of truly random hardware techniques and shows that the existing hardware
180+ on many systems can be used for this purpose. It provides suggestions to ameliorate the
181+ problem when a hardware solution is not available, and it gives examples of how large such
182+ quantities need to be for some applications. This document specifies an Internet Best
183+ Current Practices for the Internet Community, and requests discussion and suggestions for
184+ improvements.
185+ </t >
186+ </abstract >
187+ </front >
188+ <seriesInfo name =' BCP' value =' 106' />
189+ <seriesInfo name =' RFC' value =' 4086' />
190+ <seriesInfo name =' DOI' value =' 10.17487/RFC4086' />
191+ </reference >
192+ </references >
152193 </back >
153194</rfc >
0 commit comments