linux-kernel - Re: [PATCH] hw_random: add quality categories

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <200706271452.11036.mb@bu3sch.de>
Date:	Wed, 27 Jun 2007 14:52:10 +0200
From:	Michael Buesch <mb@...sch.de>
To:	Matt Mackall <mpm@...enic.com>
Cc:	Andrew Morton <akpm@...ux-foundation.org>,
	linux-kernel <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] hw_random: add quality categories

On Wednesday 27 June 2007 05:18:00 Matt Mackall wrote:
> On Tue, Jun 26, 2007 at 04:45:24PM +0200, Michael Buesch wrote:
> > On Tuesday 26 June 2007 16:32:37 Matt Mackall wrote:
> > > > No wait. You are missing the whole point of this
> > > > quality category.
> > > > The whole point of it is to prevent defaulting to a bad RNG, if
> > > > there's a bad and a good one in a machine.
> > > > Well, what's bad.
> > > > It's easy. HWRNGs like the one in bcm43xx are bad.
> > > > It's proprietary and nobody knows what it does (I guess
> > > > it gathers the entropy from the network or something
> > > > and hashes that in hardware).
> > > > So such a device would be QUAL_LOW.
> > > 
> > > If it's gathering its entropy from the network, it is not a QUAL_LOW
> > > RNG because it is not a hardware random number generator at all!
> > > 
> > > Such a device is QUAL_PSEUDO or QUAL_UNKNOWN. If it's known or
> > > suspected to be bogus, it should be so marked. 
> > 
> > No, it should not be marked pseudo. It _is_ a RNG in hardware.
> 
> Again, if it's not using an underlying physical process that's
> unpredictable, it does not deserve to be called a real HWRNG. It's no
> better than the software PRNG in the kernel at that point.
> 
> If you have a reasonable suspicion that this is the case with the BCM
> part, then you should so mark it.

Done so in the new patch.

> > No, that's not true. I explained the difference to you and it's even
> > explained in the kdoc help text. Re-read it, please.
> > HIGH is for seperate dedicated extension devices that you buy and
> > stick into your machine. So it would default to that, as you want
> > to use that by default (why would you otherwise stick it in).
> 
> I do not believe there exist devices that deserve to be classified as
> "HIGH".

You still didn't understand what I am trying to explain.
Please look at my new patch. The "DEDICATED" type is what QUAL_HIGH
meant.

Again: It is _just_ for selecting a default policy of which RNG
to enable by default. It is _not_ about quality. (And so the QUAL_XXX
defines were misnamed).

-- 
Greetings Michael.
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/