linux-kernel - Re: [PATCH] random: add random_initialized command line param

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <9811880.Zfx1jXMqj8@tauon>
Date:	Wed, 20 May 2015 18:18:01 +0200
From:	Stephan Mueller <smueller@...onox.de>
To:	Theodore Ts'o <tytso@....edu>
Cc:	Sandy Harris <sandyinchina@...il.com>,
	Herbert Xu <herbert@...dor.apana.org.au>,
	linux-crypto@...r.kernel.org, LKML <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] random: add random_initialized command line param

Am Mittwoch, 20. Mai 2015, 11:06:42 schrieb Theodore Ts'o:

Hi Theodore,

As a side note to this discussion, may I ask why entropy_total is used for 
checking against the threshold value and not entropy_count?

The reason for my question is the following: until a DRNG (in the worst case, 
nonblocking_pool is a DRNG) is fully seeded, partial seeds may be "eaten" up 
by the caller.

For the discussion, let us assume the worst case that there is coming in one 
bit of entropy at a time. In between the addition of each bit of entropy, an 
attacker can access the DRNG (i.e. the SHA1 output of the nonblocking_pool). 
When only one bit of entropy is added to the nonblocking_pool, the attack 
complexity would be 1 bit. When an attacker would access the nonblocking_pool 
after each received bit, in the worst case, the attack complexity is not 
2**128 but rather 256 (i.e. 1 bit for each individual attack between the 
addition of one new bit of entropy).

So, the total attack complexity is the sum of the individual attack 
complexities (i.e. the complexity added after the previous attack is 
performed).

When using the entropy_count variable which is affected by account() (i.e. it 
is decreased when a reader obtains data), the threshold is only reached when 
truly 128 unobserved bits are collected.

Ciao
Stephan
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/