linux-kernel - Re: [PATCH, RFC] random: introduce getrandom(2) system call

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <53C83383.4040507@amacapital.net>
Date:	Thu, 17 Jul 2014 13:35:15 -0700
From:	Andy Lutomirski <luto@...capital.net>
To:	Mark Kettenis <mark.kettenis@...all.nl>,
	Theodore Ts'o <tytso@....edu>
CC:	linux-kernel@...r.kernel.org, linux-crypto@...r.kernel.org,
	beck@...nbsd.org
Subject: Re: [PATCH, RFC] random: introduce getrandom(2) system call

On 07/17/2014 11:48 AM, Mark Kettenis wrote:
> On Thu, Jul 17, 2014, Theodore Ts'o wrote:
>>
>> The getrandom(2) system call is a superset of getentropy(2).  When we
>> add the support for this into glibc, it won't be terribly difficult
>> nor annoying to drop the following in alongside the standard support
>> needed for any new system call:
>>
>> int getentropy(void *buf, size_t buflen)
>> {
>> 	int	ret;
>>
>> 	ret = getentropy(buf, buflen, 0);
>> 	return (ret > 0) ? 0 : ret;
>> }
> 
> I'm sure you meant to use getrandom() there ;)
> 
> Since for LibreSSL we'd want a getentropy() that cannot fail the
> getrandom() call should use GRND_BLOCK flag.  Actually it makes sense
> (to me) to make blocking the default behaviour and have a
> BRND_NONBLOCK flag.  Much in the same way as you need to specify
> O_NONBLOCK if you want non-blocking behaviour for files.
> 

Can we please have a mode in which getrandom(2) can neither block nor
fail?  If that gets added, then this can replace things like AT_RANDOM.

There are non-crypto things out there that will want this.  There are
also probably VM systems (especially ones that have something like my
KVM_GET_RNG_SEED patches applied, or many VMs on Haswell, for that
matter) that will have perfectly fine cryptographically secure urandom
output immediately after bootup but that won't consider themselves
"initialized" for a while.  At least these will be perfectly fine from
the POV of those who trust their hypervisor and Intel :)

--Andy
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/