linux-kernel - Re: DRBG seeding

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20150418021624.GA2653@gondor.apana.org.au>
Date:	Sat, 18 Apr 2015 10:16:24 +0800
From:	Herbert Xu <herbert@...dor.apana.org.au>
To:	Stephan Mueller <smueller@...onox.de>
Cc:	Andreas Steffen <andreas.steffen@...ongswan.org>,
	Linux Crypto Mailing List <linux-crypto@...r.kernel.org>,
	Theodore Ts'o <tytso@....edu>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: DRBG seeding

On Sat, Apr 18, 2015 at 04:04:14AM +0200, Stephan Mueller wrote:
> 
> However, the only serious solution I can offer to not block is to use my 
> Jitter RNG which delivers entropy in (almost all) use cases. See [1]. The code 
> is relatively small and does not have any dependencies. In this case, we could 
> perform the initialization of the DRBG as follows:
> 
> 1. pull buffer of size entropy + nonce from get_random_bytes
> 
> 2. pull another buffer of size entropy + nonce from my Jitter RNG
> 
> 3. XOR both

Don't xor them.  Just provide them both as input to the seed
function.

> 4. seed the DRBG with it
> 
> 5. trigger the async invocation of the in-kernel /dev/random
> 
> 6. return the DRBG instance to the caller without waiting for the completion 
> of step 5
> 
> This way, we will get entropy during the first initialization without 
> blocking. After speaking with mathematicians at NIST, that Jitter RNG approach 
> would be accepted. Note, I personally think that the Jitter RNG has sufficient 
> entropy in almost all circumstances (see the massive testing I conducted on 
> all more widely used CPUs).
> 
> [1] http://www.chronox.de/jent.html

OK this sounds like it should satisfy everybody.

Thanks,
-- 
Email: Herbert Xu <herbert@...dor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/