Raspberry Pi devices running Raspbian may need to be patched to avoid security issues that result in the creation of weak and predictable SSH keys.
Raspbian is a free Debian-based operating system optimized for Raspberry Pi hardware . According to developer oittaa, the issue lies in the way Raspbian generates SSH keys .
Specifically, simplifying his words, oittaa stated that in Linux, the /dev/urandom function is used to generate random numbers, in parallel with the /dev/random function.
Technically, /dev/random/ is recommended because it uses user-generated entropy to produce better random numbers. By user-generated entropy, we mean the movements made by the user with the mouse, keyboard input, or various hardware-generated activities, such as disk I/O events, signal interrupts, and network packet inter-arrival times.
Unfortunately, this is a blocking operation, which freezes the operating system until it has enough entropy data to generate strong random numbers.
This is why most programmers use, instead of the previous one, /dev/urandom, which generates random numbers based on a PRNG (Pseudo-Random Number Generator) algorithm, regardless of the user's entropy data at its disposal.
In the case of Raspbian, due to a set of incorrect boots, there is not enough data, not even in the /dev/urandom function, and if the operating system is configured to generate SSH host keys correctly at boot, it will come up with predictable values that are much less secure than would generally be required for SSH data.
Raspbian and Raspberry Pi are working together to find a solution, but the issue of cryptographically secure random numbers on Linux machines is one that will continue to exist.
