linux-kernel - Re: early x86 unseeded randomness

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20170815132624.GA2688@1wt.eu>
Date:   Tue, 15 Aug 2017 15:26:24 +0200
From:   Willy Tarreau <w@....eu>
To:     "Theodore Ts'o" <tytso@....edu>, Ingo Molnar <mingo@...nel.org>,
        Borislav Petkov <bp@...en8.de>,
        Linus Torvalds <torvalds@...ux-foundation.org>,
        x86-ml <x86@...nel.org>, "Jason A. Donenfeld" <Jason@...c4.com>,
        lkml <linux-kernel@...r.kernel.org>
Subject: Re: early x86 unseeded randomness

On Tue, Aug 15, 2017 at 08:09:50AM -0400, Theodore Ts'o wrote:
> On Tue, Aug 15, 2017 at 10:05:46AM +0200, Ingo Molnar wrote:
> > > > * Willy Tarreau <w@....eu> wrote:
> > > > > 
> > > > > Nowadays we could use similar methods using RDTSC providing more accurate
> > > > > counting. This doesn't provide a lot of entropy of course, given that a
> > > > > 2 GHz machine will at most count 31 bits there. But I tend to think that
> > > > > what matters during early boot is to transform something highly predictable
> > > > > into something unlikely to be predicted (ie: an exploit having to scan 2^31
> > > > > possible addresses will not be really usable). It's also possible to do the
> > > > > same with the PIT0 counter ticking at 18.2 Hz without any correlation with
> > > > > the RTC by the way, and roughly provide 25 more bits....
> 
> All of this assumes that you have different clock crystals generating
> all of these different clock sources.  Otherwise there can be a lot
> less entropy than you expected.

That's what's cool with the RTC, it definitely runs on its own 32kHz
crystal since it continues to beat when everything else is powered off.

Willy