1

CS 161, Summer 2026 @ UC Berkeley

Slides credit: Nick Weaver, Nicholas Ngai, Peyrin Kao, Henry Corrigan-Gibbs, Jonah Bedouch

Cryptography Implementation Bugs

Lecture 19 (Transport 7)

Today: Cryptographic Implementation Bugs

Most common source of crypto bugs: Implementation.

• The scheme is theoretically secure.
• But, the practical realization of the scheme has bugs.

​

This lecture will show many real-world examples.

• You don't have to memorize them for exams.
• The takeaways are important, though.

Measuring Randomness

Lecture 19, CS 161, Summer 2026

Randomness

• Measuring Randomness
• Generating Randomness
• Breaking Randomness

Side Channels

Nothing-Up-My-Sleeve Numbers

Snake Oil Cryptography

Randomness is Essential

Cryptographic schemes assume access to random values.

• "Random" secret keys for encryption and MAC.
• "Random" IVs and nonces for AES-CTR/AES-GCM.
• "Random" numbers chosen for Diffie-Hellman key exchange.
• "Random" numbers needed for digital signatures.

​

If an attacker can predict a random number, things can catastrophically fail.

• How do we securely generate "random" values?

What is Randomness?

For cryptography: "Sample uniformly at random."

• Goal: Attackers can't use the sampling method to get a hint at your key.
• Example: In a fair coin toss, an attacker has a 50% chance of getting it right.
• If the coin is weighted, the chance increases. �(Shannon's Maxim: Attacker knows the probability of heads/tails.)

​

Notice: Randomness is not a property of the value, it's a property of the method used to generate the value.

• Knowing that a coin landed on "heads" is not enough to tell you whether the coin was fair.
• Looking at "9f42b057444" is not enough to tell you if the value is random, you need to know how the value was generated!

Measuring Randomness: Entropy

Entropy is a measure of uncertainty, i.e. how unpredictable outcomes are.

• A scheme with high entropy has unpredictable outcomes, which is what we want.
• The uniform distribution has the highest entropy, since every outcome is equally likely (e.g. a fair coin toss).
• Usually measured in "bits."�Example: 3 bits of entropy = uniform, random distribution over 8 values.

Randomness Is Hard To Measure

Measuring entropy/randomness is hard, because:

• Bad randomness rarely impacts correctness.
• Messages will still encrypt/decrypt correctly.
• Bad randomness is hard to test for.
• Challenge: randomness is about the process, not the output.
• Looking at the output is not enough (i.e. "does it look different every time")

Sampling Algorithm

​

​

​

​

H(time_of_day)

9f42b057444dcdbfcaa4b6f34b527e58871e0532480f933abac0bb018c7b8f2d

b51f2044c51e11fddcd26fbe786c4f82e3db220b2ab8b79705abec08bebd0509

a2d2fde7f469b706ea8d26a6121b00045c847e17612ba80ca1a56cdcbcc6653a

Unique every time, looks totally random!

Super easy for an attacker to guess…

Bad Randomness is a Real Problem

If you generate keys with bad randomness, an attacker may be able to recover them!�Example:

• A service generates keys with H(time in milliseconds).
• If you know the year a key was made, there are 2³⁵ possible values of "time."
• Can be brute forced!

​

Some schemes fail completely when randomness is reused. �Example:

• DSA/ECDSA is a signature scheme (implementation out of scope).
• DSA relies on a unique nonce for each signature.
• Two messages with the same nonce → The attacker can learn the nonce.
• The attacker learns the nonce → The attacker learns the signing key.

Generating Randomness

Lecture 19, CS 161, Summer 2026

Randomness

• Measuring Randomness
• Generating Randomness
• Breaking Randomness

Side Channels

Nothing-Up-My-Sleeve Numbers

Snake Oil Cryptography

True Randomness

True randomness comes from physical phenomena (hardware, not software).

​

Common sources of randomness:

• Measure the physical environment at extremely fine granularity.�(Current time, temperature, time of keypresses, mouse movement, etc.)
• Build a circuit that behaves unpredictably on purpose.

​

Problem: Hardware randomness is expensive and slow.

Exotic entropy source: Cloudflare has a video stream of a wall of lava lamps.

CPU�Clock

Mouse Wiggle

Key Presses

Random Circuit

Hardware

Software Randomness with PRNGs

To make randomness cheap/fast:

• Multiple hardware sources are hashed into a seed.
• The operating system uses a deterministic algorithm called a pseudorandom number generator (PRNG) to turn this seed into a longer pseudorandom output.

CPU�Clock

Mouse Wiggle

Key Presses

Random Circuit

Hash

Seed

OS's PRNG

Pseudorandom Output

Hardware

Operating System (OS)

Pseudorandom Number Generators (PRNGs)

PRNGs use a little bit of true randomness to generate a lot of random-looking output.

A PRNG should be seeded with all available sources of entropy.

• As long as one source is good, results will be good.
• If all sources are independent, total entropy is sum of the entropy of each source, so more sources never hurts and can help.

Reseeding can be used to add even more entropy as it becomes available.

Many PRNGs also support reseeding. (Not shown in this definition.)

CTR-DRBG

​

An example of a PRNG: CTR-DRBG, based on CTR mode!

• The truly random seed is used as a key.
• To generate a new block of pseudorandom output, increment the counter by 1 and output E(seed, counter).

0

AES Enc

E(Seed, 0)

Seed

1

AES Enc

E(Seed, 1)

Seed

2

AES Enc

E(Seed, 2)

Seed

As-good-as-random bits

…

"Deterministic Random Bit Generator," another term for PRNGs.

Software Randomness with PRNGs

To access randomness, the application has to ask the operating system (using a syscall).

• Syscalls are generally slow and expensive.

​

Solution:

• Ask the OS for a little bit of output (expensive).
• Then, use it to seed an application-level PRNG and generate lots of output (cheap).

CPU�Clock

Mouse Wiggle

Key Presses

Random Circuit

Hash

Seed

OS's PRNG

Pseudorandom Output

Hardware

Operating System (OS)

Application's PRNG

Cryptographic Secrets

Application

Breaking Randomness

Lecture 19, CS 161, Summer 2026

Randomness

• Measuring Randomness
• Generating Randomness
• Breaking Randomness

Side Channels

Nothing-Up-My-Sleeve Numbers

Snake Oil Cryptography

Breaking Randomness at Hardware-Level

At the hardware level, weak sources of entropy can be guessed.

​

Example: Network routers (2008).

• Many routers lack true randomness sources (e.g. no keyboard, no mouse wiggles).
• Even worse, many routers generate their key as soon as they boot.
• Result: Many routers had the exact same key.

​

​

​

Fixes: Use more diverse sources of randomness, wait longer to gather more entropy.

Researchers recovered 0.5% of private keys for TLS hosts!

CPU�Clock

Mouse Wiggle

Key Presses

Random Circuit

Hash

Seed

OS's PRNG

Pseudorandom Output

Hardware

Operating System (OS)

Application's PRNG

Cryptographic Secrets

Application

Breaking Randomness at OS-Level

At the OS level, seed reuse can occur.

​

Example: VMs.

• VMs are a way to run multiple operating systems on one machine. (e.g. CS 161 Project 1)
• Can "clone" a VM to run many copies at the same time. (e.g. the s330 machines for Project 1)
• If not careful: Both clones could be seeded with exactly the same state.
• Two different clones using same randomness�→ Key compromise is possible.

​

A similar problem exists at the application layer when using fork() to clone processes.

Hash

Seed

OS's PRNG

Pseudorandom Output

Operating System (OS)

CPU�Clock

Mouse Wiggle

Key Presses

Random Circuit

Hardware

Application's PRNG

Cryptographic Secrets

Application

Breaking Randomness at Application-Level (1/3): Insufficient Randomness

At the application level, it's possible for a bug to prevent randomness from ever reaching the PRNG.

​

Example: OpenSSL on Debian (2008).

• OpenSSL seeds PRNG with:�Process ID and Hardware Randomness.
• Someone noticed a memory leak in the code that added hardware randomness to the seed…
• ...and "fixed" it by deleting the entire function.
• There are only 2¹⁵ (32,768) possible Process IDs, which made randomness easy to guess.

​

Fix: Don't touch crypto code if you don't know what it does.

Hash

Seed

OS's PRNG

Pseudorandom Output

Operating System (OS)

CPU�Clock

Mouse Wiggle

Key Presses

Random Circuit

Hardware

Application's PRNG

Cryptographic Secrets

Application

Breaking Randomness at Application-Level (2/3): Bad PRNG

At the application level, it's possible to use a completely insecure PRNG.

​

Not all PRNGs are cryptographic PRNGs!

• Many are faster, but distinguishable from random.
• Useful in randomized data structures, not crypto.
• The default in most libraries is insecure!

​

Example: Slot machine hacking (2017).

• Many slot machines used an insecure PRNG.
• Attackers were able to win with high probability.

Hash

Seed

OS's PRNG

Pseudorandom Output

Operating System (OS)

CPU�Clock

Mouse Wiggle

Key Presses

Random Circuit

Hardware

Application's PRNG

Cryptographic Secrets

Application

[Not in scope] Try This At Home?

🤑

Breaking Randomness at Application-Level (3/3): PRNG Output Misuse

At the application layer, you can use secure randomness wrong, e.g. not using random IVs.

​

Example: Sony PlayStation 3 (2010).

• Sony added code to prevent owners from loading their own OS: Only software signed by Sony would run.
• Sony used ECDSA to sign code.
• Problem: Sony used a fixed ECDSA nonce.
• Researchers recovered Sony's signing key.

Hash

Seed

OS's PRNG

Pseudorandom Output

Operating System (OS)

CPU�Clock

Mouse Wiggle

Key Presses

Random Circuit

Hardware

Application's PRNG

Cryptographic Secrets

Application

The key was burned into hardware, so Sony couldn't change it.

Recall: ECDSA with a fixed nonce leaks the key!

There's More Where That Came From

Randomness bugs are very common.

• CVE-2013-7372: Bug in Java library used a good PRNG, but passed in a <64-bit seed, which made the output guessable. Broke many Android apps.
• CVE-2019-16303: Bug in JHipster made password reset links guessable.
• CVE-2026-9323: Python web backend (urwid) used non-cryptographic PRNG to generate session tokens.
• CVE-2026-9733: Perl OAuth2 library used insecure PRNG which enabled CSRF.

CVE stands for "Common Vulnerabilities and Exposures," a public database maintained by security researchers.

Side Channels

Lecture 19, CS 161, Summer 2026

Randomness

• Measuring Randomness
• Generating Randomness
• Breaking Randomness

Side Channels

Nothing-Up-My-Sleeve Numbers

Snake Oil Cryptography

Side Channels

Side channels: Information about the plaintext revealed as a result of the implementation of the scheme, not the scheme itself.

• Modern crypto systems are usually broken through side channels.

​

While a scheme runs, an attacker could observe:

• How long it takes to run.
• How much power is consumed.
• How loud the device is.
• The network traffic being sent.
• Electromagnetic waves from the device.
• The cache/memory on the device.
• etc.

More on side channels when we discuss isolation.

Nothing Up My Sleeve Numbers

Lecture 19, CS 161, Summer 2026

Randomness

• Measuring Randomness
• Generating Randomness
• Breaking Randomness

Side Channels

Nothing-Up-My-Sleeve Numbers

Snake Oil Cryptography

Public Constants in Cryptography

Cryptography uses a lot of public constants:

• Initial state for SHA hashes.
• Prime p and generator g in Diffie-Hellman key exchange.
• Parameters for elliptic-curve cryptography (curve equations, points on the curve like P and Q).
• Constant values in the AES block cipher (called "S-Box").

​

Usually, any value works, but the designer needs to choose some constant.

• Example: In Diffie-Hellman, any large prime p and generator g works, but there’s a default p and g that everyone uses.
• Where do these default parameter values come from?

Dual EC DRBG: Something Up Their Sleeves

DUAL_EC_DRBG was a NSA-proposed PRNG added to NIST standards in 2006.

It had many problems from the start — it wasn't even a good PRNG!

• Slow and biased. (Given an output, 0.1% chance of predicting the next one.)

After a while, security researchers noticed something…

• Scheme relied on two points on a polynomial.
• If points were independent, the scheme was secure.
• If not, someone who knows the relationship�between the points could break the scheme.
• So… how did the NSA choose the points? No one knows.

Theory: NSA proposed the scheme on purpose to learn secret keys.

In general, a backdoor is an undocumented method of bypassing cryptography schemes (such as the relationship in this scheme).`

And used their influence to add the scheme to the standards, so that developers would use it by default.

DES: Something Up Their Sleeves...Maybe?

Mysterious public parameters can cast doubt, even when a design is solid.

​

Example: DES was the block cipher standard before AES.

• Developed by IBM, with input from the NSA.
• Everyone was suspicious that the NSA tampered with the S-box constants to introduce a backdoor.
• It turns out, they did: The NSA made the algorithm stronger against an attack that they knew about, but the public didn't know about.

Moral of the Story: Nothing-Up-My-Sleeve Numbers

Good systems should transparently describe how public parameters are generated:

• Argue why specific values provide good security.
• AES did this for its S-box values.
• Choose values with obvious human significance.
• Example: The first few digits of π. (used by the old MD2 hash).
• Example: 0x67452301, 0xefcdab89, … (used by SHA-1).
• Example: Digits of √2, √3, √5, ... (used by SHA-2).
• The developer probably doesn't have millions of�values to brute-force and find one with a backdoor.

Snake Oil Cryptography

Lecture 19, CS 161, Summer 2026

Randomness

• Measuring Randomness
• Generating Randomness
• Breaking Randomness

Side Channels

Nothing-Up-My-Sleeve Numbers

Snake Oil Cryptography

Snake Oil

Snake oil: Fraudulent "cure-all" medicines sold in the 1700s and 1800s.

​

Snake oil cryptography: Useless security products sold to uninformed buyers.

• Uses deceptive advertising to trick buyers.

Signs of Snake Oil Cryptography (1/2)

Amazingly long key lengths.

• Once brute-forcing a key becomes astronomically hard, making it longer probably doesn't provide extra security.
• The NSA is super paranoid, and even they don’t use >256-bit symmetric keys or >4,096-bit public keys.

​

New algorithms and wild protocols.

• There is no reason to use a brand-new block cipher, hash algorithm, etc.
• Existing protocols have been vetted by security experts for years: They’re widespread for a good reason!
• New protocols probably means someone is trying to write their own crypto. (and asking for trouble!)

NSA = National Security Agency, part of the US government.

Signs of Snake Oil Cryptography (2/2)

Fancy-sounding technical buzzwords.

• Claims of inventing "new math."

​

"One time pads."

• One-time pads are highly impractical, since you need new key each time.
• Most schemes advertised as "one-time pads" probably aren't true one-time pads.
• Wacky stream ciphers (often self-designed) might be sold as "one-time pads."

​

Rigged "cracking contests."

• Advertising a secure scheme by challenging the public to break the scheme.
• The challenge might be "decrypt this message" with no context or structure, making the challenge impossible (even if the scheme is insecure).

Snake Oil Cryptography Example: Nick Weaver vs. Crown-Sterling (1/2)

Buzzwords, wild new math, and rolling your own crypto are all signs of snake oil.

Snake Oil Cryptography Example: Nick Weaver vs. Crown-Sterling (2/2)