linux-kernel - Re: entropy of /dev/random vs. openssl rand

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Sat, 28 Apr 2007 20:26:14 +0300
From:	Jari Ruusu <jariruusu@...rs.sourceforge.net>
To:	Gisle Sælensminde 
	<Gisle.Salensminde@...s.uib.no>
Cc:	linux-crypto@...linux.org, linux-kernel@...r.kernel.org
Subject: Re: entropy of /dev/random vs. openssl rand

Gisle Sælensminde wrote:
> Some people argue that a periodically reseeded cryptographic-quality
> random number generator is as secure as a true random number generator for
> all practical purposes.
[snip]
> I personally can't think of any realistic scenario where /dev/random would
> make you safe while /dev/urandom would make you sorry.

No problem if cryptographic-quality random number generator is reseeded
using high quality entropy. But saving/reseeding PRNG using a plaintext file
as most distros seem to do at shutdown and boot does not count as secure.
/dev/urandom state may be predictable for some time after boot. /dev/random
at least waits for new entropy before handing out random bits, and avoids
that predictable state pitfall.

Do most distros attempt to overwrite /var/lib/urandom/random-seed or
whatever after it has been used to reseed /dev/urandom? Does any distro
attempt to overwrite that file?

For the record, loop-AES versions of mount/losetup/swapon that set up random
key loop devices, use /dev/urandom. But they also attempt to work-around
possibly predictable boot-time /dev/urandom bits. The work-around is
basically random-seed save/restore (to backing device) but with 20
overwrites of saved-state after it has been used to create new encryption
keys. See source for more details.

-- 
Jari Ruusu  1024R/3A220F51 5B 4B F9 BB D3 3F 52 E9  DB 1D EB E3 24 0E A9 DD
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/