linux-kernel - Re: [PATCH,RFC] random: collect cpu randomness

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <52EEF0C9.8080002@zytor.com>
Date:	Sun, 02 Feb 2014 17:28:41 -0800
From:	"H. Peter Anvin" <hpa@...or.com>
To:	Jörn Engel <joern@...fs.org>,
	Stephan Mueller <smueller@...onox.de>
CC:	"Theodore Ts'o" <tytso@....edu>,
	Linux Kernel Developers List <linux-kernel@...r.kernel.org>,
	macro@...ux-mips.org, ralf@...ux-mips.org, dave.taht@...il.com,
	blogic@...nwrt.org, andrewmcgr@...il.com, geert@...ux-m68k.org,
	tg@...bsd.de
Subject: Re: [PATCH,RFC] random: collect cpu randomness

On 02/02/2014 05:24 PM, Jörn Engel wrote:
> 
> For my part, I think the whole business of estimating entropy is
> bordering on the esoteric.  If the hash on the output side is any
> good, you have a completely unpredictable prng once the entropy pool
> is unpredictable.  Additional random bits are nice, but not all that
> useful.  Blocking /dev/random based on entropy estimates is likewise
> not all that useful.
> 
> Key phrase is "once the entropy pool is unpredictable".  So early in
> bootup it may make sense to estimate the entropy.  But here the
> problem is that you cannot measure entropy, at least not within a
> single system and a reasonable amount of time.  That leaves you with a
> heuristic that, like all heuristics, is wrong.
> 

The entropy bound needs to be a conservative lower bound.  Its main use
is to provide backpressure (should we spend more CPU time producing
entropy) although the forward pressure on /dev/random is potentially
useful for high security applications.

This does NOT mean that zero-credit entropy generation is useless, far
from it.  It just means that we are doing it on an "it can't hurt"
basis, rather than "I know for sure that this is valuable."

	-hpa

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/