linux-kernel - Re: [PATCH v5 0/5] random,x86,kvm: Rework arch RNG seeds and get some from kvm

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CALCETrVA3Eefbhfu_pO28fFPLCZvMBZHj=vpGifkUcBPa0Np1w@mail.gmail.com>
Date:	Wed, 13 Aug 2014 01:37:01 -0700
From:	Andy Lutomirski <luto@...capital.net>
To:	"H. Peter Anvin" <hpa@...or.com>
Cc:	Raghavendra K T <raghavendra.kt@...ux.vnet.ibm.com>,
	Paolo Bonzini <pbonzini@...hat.com>, X86 ML <x86@...nel.org>,
	Bandan Das <bsd@...hat.com>, Gleb Natapov <gleb@...nel.org>,
	kvm list <kvm@...r.kernel.org>,
	"Theodore Ts'o" <tytso@....edu>,
	Srivatsa Vaddagiri <vatsa@...ux.vnet.ibm.com>,
	Daniel Borkmann <dborkman@...hat.com>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	Andrew Honig <ahonig@...gle.com>,
	Kees Cook <keescook@...omium.org>
Subject: Re: [PATCH v5 0/5] random,x86,kvm: Rework arch RNG seeds and get some
 from kvm

On Aug 13, 2014 12:48 AM, "H. Peter Anvin" <hpa@...or.com> wrote:
>
> On 08/12/2014 12:22 PM, Andy Lutomirski wrote:
> > On Tue, Aug 12, 2014 at 12:17 PM, Theodore Ts'o <tytso@....edu> wrote:
> >> On Tue, Aug 12, 2014 at 12:11:29PM -0700, Andy Lutomirski wrote:
> >>>
> >>> What's the status of this series?  I assume that it's too late for at
> >>> least patches 2-5 to make it into 3.17.
> >>
> >> Which tree were you hoping this patch series to go through?  I was
> >> assuming it would go through the x86 tree since the bulk of the
> >> changes in the x86 subsystem (hence my Acked-by).
> >
> > There's some argument that patch 1 should go through the kvm tree.
> > There's no real need for patch 1 and 2-5 to end up in the same kernel
> > release, either.
> >
> >>
> >> IIRC, Peter had some concerns, and I don't remember if they were all
> >> addressed.  Peter?
> >>
> >
> > I don't know.  I rewrite one thing he didn't like and undid the other,
> > but there's plenty of opportunity for this version to be problematic, too.
> >
>
> Sorry, I have been heads down on the current merge window.  I will look
> at this for 3.18, presumably after Kernel Summit.
>
> The proposed arch_get_rng_seed() is not really what it claims to be; it
> most definitely does not produce seed-grade randomness, instead it seems
> to be an arch function for best-effort initialization of the entropy
> pools -- which is fine, it is just something quite different.

Fair enough.  I meant "seed" as in something that initialized a PRNG
(think srand), not "seed" as in a
promised-to-be-cryptographically-secure seed for a DRBG.

I can rename it, update the comment, or otherwise tweak it to make the
intent clearer.

>
> I want to look over it more carefully before acking it, though.

It would also be nice for someone with a Haswell box (and an RDSEED
box) to test it.  I have neither.

>
> Andy, are you going to be in Chicago?

Yes.

>
>         -hpa
>
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/