linux-kernel - Re: Linux messages full of `random: get_random

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20180424135621.GD4189@thunk.org>
Date:   Tue, 24 Apr 2018 09:56:21 -0400
From:   "Theodore Y. Ts'o" <tytso@....edu>
To:     Paul Menzel <pmenzel+linux-random-number@...gen.mpg.de>
Cc:     linux-kernel@...r.kernel.org
Subject: Re: Linux messages full of `random: get_random_u32 called from`

On Tue, Apr 24, 2018 at 01:48:16PM +0200, Paul Menzel wrote:
> Dear Linux folks,
> 
> w
> Since Linux 4.17-rcX, Linux spams a lot of `random: get_random_u32 called
> from` messages. I believe, this setting should be reverted by default as
> otherwise a lot of other messages are not seen.

Can you tell me a bit about your system?  What distribution, what
hardware is present in your sytsem (what architecture, what
peripherals are attached, etc.)?

There's a reason why we made this --- we were declaring the random
number pool to be fully intialized before it really was, and that was
a potential security concern.  It's not as bad as the weakness
discovered by Nadia Heninger in 2012.  (See https://factorable.net for
more details.)  However, this is not one of those things where we like
to fool around.

So I want to understand if this is an issue with a particular hardware
configuration, or whether it's just a badly designed Linux init system
or embedded setup, or something else.  After all, you wouldn't want
the NSA spying on all of your network traffic, would you?  :-)

    	       	      	      	      - Ted