Analysis of the Random Number Generator Using MD5 PRNG in Linux Kernel

When random numbers are needed, kernel level threads can use at least one of two random number generators (RNGs), called LRNG and MD5 PRNG. LRNG is a well-known cryptographic RNG accessed via /dev/(u)random and MD5 PRNG provides a function interface get_random_int(). While the /dev/(u)random has been investigated a lot, MD5 PRNG had been regarded as a less important one. In this paper, we demonstrate MD5 PRNG is vulnerable against a generic attack by searching entropy source in some embedded systems. In fact, once a random number is obtained, one can predict previous outputs of MD5 PRNG. Even though the RNG uses high resolution clock of microsecond unit as an entropy source, we can recover random number by reducing search space. We suggest a generic attack which the attacker just guesses entropy source at most 2 times. This attack can be done within 74 hours using parallel implementation with NVIDIA GeForce Titan X.