linux-kernel - Re: [PATCH 07/10] random: add new get_random_bytes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CA+55aFxk3eViz1-CuuHf8xxTgLth376K_cOKAtAj0waXAz+GWg@mail.gmail.com>
Date:	Thu, 5 Jul 2012 11:35:12 -0700
From:	Linus Torvalds <torvalds@...ux-foundation.org>
To:	"Theodore Ts'o" <tytso@....edu>
Cc:	Linux Kernel Developers List <linux-kernel@...r.kernel.org>,
	w@....eu, ewust@...ch.edu, zakir@...ch.edu, greg@...ah.com,
	mpm@...enic.com, nadiah@...ucsd.edu, jhalderm@...ch.edu,
	tglx@...utronix.de, davem@...emloft.net, stable@...nel.org
Subject: Re: [PATCH 07/10] random: add new get_random_bytes_arch() function

On Thu, Jul 5, 2012 at 11:12 AM, Theodore Ts'o <tytso@....edu> wrote:
> Create a new function, get_random_bytes_arch() which will use the
> architecture-specific hardware random number generator if it is
> present.  Change get_random_bytes() to not use the HW RNG, even if it
> is avaiable.

This is horrible, I think. NAK NAK NAK.

If Intel's rng really isn't trustworthy, they'll get a *huge* black
eye for it. It would be a total PR disaster for Intel, so they have
huge incentives to be trustworthy.

And in the meantime, your patch now slows things down for no obvious
reason, and gives randomness that is *pracitcally* worse because you
have some theoretical concerns that seem really unlikely to begin
with.

Christ, we *know* that our nonblocking pool isn't perfect either.
That's why all the changes in the first place. It's *more* likely that
somebody cracks our nonblocking pool on embedded devices where
interrupts may be pretty predictable than that Intel's RNG is not
trustworthy - and crackable.

So don't do this. It's stupid.

If you really don't trust the intel rng, and have some *reason* not to
trust it, there's a perfectly fine solution to that:

 - add a flag (that is *off* by default, so that it doesn't hurt
normal people) to go to "extra scary mode"

 - in extra scary mode, you *still* use the hwrng, but you never give
the data as-is, you mix it into the nonblocking pool *first*, and then
extract.

In absolutely *no* case is it acceptable to say "we don't trust the hw
rng, so we won't use it at all, and instead use our known nonblocking
pool that we can't guarantee is random either".

Really.

I absolutely *detest* patches like this that make *practical* security
worse, in the name of some idiotic theoretical worry that nobody has
any reason to believe is real.

If "get_random_bytes()" doesn't use the hw rng when it exists, it is
broken. It's that simple.

              Linus
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/