linux-kernel - Re: [PATCH v4 0/5] /dev/random

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	31 May 2016 18:34:46 -0400
From:	"George Spelvin" <linux@...encehorizons.net>
To:	herbert@...dor.apana.org.au, smueller@...onox.de, tytso@....edu
Cc:	andi@...stfloor.org, cryptography@...edaemon.net,
	hpa@...ux.intel.com, joe@...ches.com, jsd@...n.com,
	linux-crypto@...r.kernel.org, linux-kernel@...r.kernel.org,
	linux@...izon.com, pavel@....cz, sandyinchina@...il.com
Subject: Re: [PATCH v4 0/5] /dev/random - a new approach

I'll be a while going through this.

I was thinking about our earlier discussion where I was hammering on
the point that compressing entropy too early is a mistake, and just
now realized that I should have given you credit for my recent 4.7-rc1
patch 2a18da7a.  The hash function ("good, fast AND cheap!") introduced
there exploits that point: using a larger hash state (and postponing
compression to the final size) dramatically reduces the requirements on
the hash mixing function.

I wasn't conscious of it at the time, but I just now realized that
explaining it clarified the point in my mind, which led to applying
the principle in other situations.

So thank you!