A state compromise extension attack predicts a pseudorandom generator’s future outputs after recovering, computing, or exploiting its internal state. Because a PRNG mutates one state into the next, reversing or reproducing that transition extends the observed sequence. section 2.2.3 section 2.3
A practical attack follows this pattern:
- Observe one or more generator outputs. section 3.2.4
- Recover or infer the corresponding internal state, directly or through a secret state-transition relationship. section 2.2.3 section 3.2.4
- Advance the recovered state to reproduce every subsequent output. section 3.2.4
DUAL_EC_DRBG demonstrates the failure even in a CSPRNG. If constants satisfy P = dQ and an attacker knows d, observed output can be tested against candidate hidden coordinates; the matching candidate yields the next state and output. The implementation brute-forces two missing output bytes, validates elliptic-curve points, and verifies the clone against later generated values. section 3.2.4
Equation 3.5
\[\begin{aligned} \begin{aligned} s_0 &= \text{Seed} \\ o_0 &= t(X({s_0}Q)) \\ s_1 &= X({s_0}P) \\ o_1 &= t(X({s_1}Q)) \end{aligned} \label{equation:dualec-exploit-1} \end{aligned}\]The state-and-output equations show how DUAL_EC_DRBG transforms a seed into successive states and truncated outputs. section 3.2.4
Defend against extension by using a CSPRNG, seeding it with high-quality TRNG output, and periodically reseeding so one compromised or reused state does not control the sequence indefinitely. section 2.3 section 2.2.3
