Release notes: Tier F RNG exploit suite (rng-exploit-suite)¶

Branch: cursor/httpd-plan-continue

Summary¶

Tier F RNG exploits: BadRng/SimRng injection via exploit [server.rng] merged into bench configs; fast unit oracles in li-tests/rng/exploits/; PR gate run_rng_exploits.sh when touching packages/li-rng or packages/li-tls.

Changed¶

• scripts/httpd_bad_rng.py, benchmarks/harness/rng_inject.py
• benchmarks/tier5_http/exploits/rng_*.toml, drivers, suite_exploits.toml, nginx_mitigations.toml
• li-tests/rng/exploits/bad_rng_iv_oracle.li, sim_rng_replay.li
• scripts/run_rng_exploits.sh, scripts/check-rng-exploit-suite.sh
• scripts/prob_check.py — BadRng adversarial MC for iv_collision
• Plan todo rng-exploit-suite → completed

Test commands¶

./scripts/run_rng_exploits.sh
./scripts/check-rng-exploit-suite.sh
HTTPD_GATES_SKIP_LIC_BUILD=1 ./scripts/httpd-plan-gates.sh  # after lic built once
./scripts/httpd-plan-gates.sh

Not changed¶

• Live Pages bench refresh (SKIP_BENCH=1)
• Full li-httpd TLS handshake integration (stub oracle default; set LI_HTTPD_BIN for live)
• li_rt_rng.c getrandom seam (G-runtime follow-up)

Breaking / Security / Performance / Downstream¶