| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <mj+md-20061128.131233.3594.atrey@ucw.cz> Date: Tue, 28 Nov 2006 14:15:28 +0100 From: Martin Mares <mj@....cz> To: David Wagner <daw-usenet@...erner.cs.berkeley.edu> Cc: linux-kernel@...r.kernel.org Subject: Re: Entropy Pool Contents Hello! > - Whether you automatically bump up the entropy estimate when > root users write to /dev/random is a design choice where you could > reasonably go either way. On the one hand, you might want to ensure > that root has to take some explicit action to allege that it is > providing a certain degree of entropy, and you might want to insist > that root tell /dev/random how much entropy it added (since root > knows best where the data came from and how much entropy it is likely > to contain). More importantly, it should be possible for root to write to /dev/random _without_ increasing the entropy count, for example when restoring random pool contents after reboot. In such cases you want the pool to contain at least some unpredictable data before real entropy arrives, so that /dev/urandom cannot be guessed, but you unless you remember the entropy counter as well, you should not add any entropy. Have a nice fortnight -- Martin `MJ' Mares <mj@....cz> http://atrey.karlin.mff.cuni.cz/~mj/ Faculty of Math and Physics, Charles University, Prague, Czech Rep., Earth Q: How to start hacking Linux? A: vi /boot/vmlinuz - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists