linux-kernel - Re: [PATCH 0/2] Add support for Qualcomm's PRNG

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 10 Oct 2013 08:08:25 -0700
From:	"H. Peter Anvin" <hpa@...or.com>
To:	Paul Mackerras <paulus@...ba.org>
CC:	Stanimir Varbanov <svarbanov@...sol.com>,
	"Theodore Ts'o" <tytso@....edu>,
	Rob Herring <rob.herring@...xeda.com>,
	Pawel Moll <pawel.moll@....com>,
	Mark Rutland <mark.rutland@....com>,
	Stephen Warren <swarren@...dotorg.org>,
	Ian Campbell <ijc+devicetree@...lion.org.uk>,
	Matt Mackall <mpm@...enic.com>,
	Herbert Xu <herbert@...dor.hengli.com.au>,
	linux-kernel@...r.kernel.org, Rob Landley <rob@...dley.net>,
	devicetree@...r.kernel.org, linux-doc@...r.kernel.org,
	Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	linux-arm-msm@...r.kernel.org
Subject: Re: [PATCH 0/2] Add support for Qualcomm's PRNG

On 10/10/2013 03:41 AM, Paul Mackerras wrote:
> On Wed, Oct 09, 2013 at 08:07:35AM -0700, H. Peter Anvin wrote:
> 
>> consider the PowerPC random number generator[1]) and
> 
> [snip]
> 
>> [1] which has a known first-order bias which they "correct" for by
>> XORing two datums together in a very simple data reduction step.
> 
> 65 actually, not two.
> 
>> However, if their random source has bias it is extremely likely it also
>> has nonzero correlations, which require stronger reductions.  It would
> 
> The correlations are essentially zero, by design, and experiment
> confirms it.  Did you see my mail on the kvm list where I explained
> how it works?
> 

No, sorry... I got a bit of detached discussion as part of benh talking
about KVM and randomness (for the record, I'm all for better randomness
on all platforms.)

Either way, XORing samples is a pretty inefficient (both in terms of
anticorrelation and in terms of entropy efficiency) form of data
reduction/conditioning.  It would still be better to feed the output
into the pool with a 65x derating.

	-hpa


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/