linux-kernel - Re: Why does reading from /dev/urandom deplete entropy so much?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4755D350.1080801@redhat.com>
Date:	Tue, 04 Dec 2007 16:23:12 -0600
From:	Mike McGrath <mmcgrath@...hat.com>
To:	Matt Mackall <mpm@...enic.com>
CC:	Alan Cox <alan@...rguk.ukuu.org.uk>, Theodore Tso <tytso@....edu>,
	Ray Lee <ray@...rabbit.org>, Adrian Bunk <bunk@...nel.org>,
	Marc Haber <mh+linux-kernel@...schlus.de>,
	linux-kernel@...r.kernel.org
Subject: Re: Why does reading from /dev/urandom deplete entropy so much?

Matt Mackall wrote:
> On Tue, Dec 04, 2007 at 03:18:27PM -0600, Mike McGrath wrote:
>   
>> Matt Mackall wrote:
>>     
>>> which would have been in v2.6.22-rc4 through the normal CVE process.
>>> The only other bits in there are wall time and utsname, so systems
>>> with no CMOS clock would behave repeatably. Can we find out what
>>> kernels are affected?
>>>
>>>  
>>>       
>> We can but it will likely take a few weeks to get a good sampling. UUID 
>> is unique in the db so when someone checks in with the same UUID, the 
>> old one gets overwritten.
>>     
>
> We can probably assume that for whatever reason the two things with
> duplicate UUID had the same seed. If not, we've got -much- bigger
> problems.
>   

Ok, I think I see whats going on here. I have some further investigation 
to do but it seems that the way our Live CD installer works is causing 
these issues. I'm going to try to grab some live CD's and hardware to 
confirm but at this point it seems thats whats going on.

-Mike
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/