linux-kernel - Re: [PATCH v3 0/8] Rework random blocking

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 26 Dec 2019 19:12:29 +0800
From:   Andy Lutomirski <luto@...capital.net>
To:     Stephan Müller <smueller@...onox.de>
Cc:     Andy Lutomirski <luto@...nel.org>, Ted Ts'o <tytso@....edu>,
        LKML <linux-kernel@...r.kernel.org>,
        Linux API <linux-api@...r.kernel.org>,
        Kees Cook <keescook@...omium.org>,
        "Jason A. Donenfeld" <Jason@...c4.com>,
        "Ahmed S. Darwish" <darwish.07@...il.com>,
        Lennart Poettering <mzxreary@...inter.de>,
        "Eric W. Biederman" <ebiederm@...ssion.com>,
        "Alexander E. Patrakov" <patrakov@...il.com>,
        Michael Kerrisk <mtk.manpages@...il.com>,
        Willy Tarreau <w@....eu>,
        Matthew Garrett <mjg59@...f.ucam.org>,
        Ext4 Developers List <linux-ext4@...r.kernel.org>,
        linux-man <linux-man@...r.kernel.org>
Subject: Re: [PATCH v3 0/8] Rework random blocking



> On Dec 26, 2019, at 5:29 PM, Stephan Müller <smueller@...onox.de> wrote:
> 
> Am Montag, 23. Dezember 2019, 09:20:43 CET schrieb Andy Lutomirski:
> 
> Hi Andy,
>> 
>> There are some open questions and future work here:
>> 
>> Should the kernel provide an interface to get software-generated
>> "true random" numbers?  I can think of only one legitimate reason to
>> use such an interface: compliance with government standards.  If the
>> kernel provides such an interface going forward, I think it should
>> be a brand new character device, and it should have a default mode
>> 0440 or similar.  Software-generated "true random numbers" are a
>> very limited resource, and resource exhaustion is a big deal.  Ask
>> anyone who has twiddled their thumbs while waiting for gnupg to
>> generate a key.  If we think the kernel might do such a thing, then
>> patches 5-8 could be tabled for now.
> 
> What about offering a compile-time option to enable or disable such code?
> Note, with the existing random.c code base, there is no need to have a 
> separate blocking_pool. The ChaCha20 DRNG could be used for that very same 
> purpose, provided that in case these true random numbers are generated when 
> the Chacha20 DRNG received an equal amount of "unused" entropy.

This scares me. The DRNG should be simple and easy to understand. If we’re tapping extra numbers in some weird way, then I would be more comfortable with some clear assurance that this doesn’t break the security. If we’re tapping numbers in the same way as normal urandom, then I don’t really see the point.

>> 
>> Alternatively, perhaps the kernel should instead provide a
>> privileged interface to read out raw samples from the various
>> entropy sources, and users who care could have a user daemon that
>> does something intelligent with them.  This would push the mess of
>> trying to comply with whatever standards are involved to userspace.
>> Userspace could then export "true randomness" via CUSE if it is so
>> inclined, or could have a socket with a well-known name, or whatever
>> else seems appropriate.
> 
> With the patch set v26 of my LRNG I offer another possible alternative 
> avoiding any additional character device file and preventing the starvation of 
> legitimate use cases: the LRNG has an entropy pool that leaves different 
> levels of entropy in the pool depending on the use cases of this data.
> 
> If an unprivileged caller requests true random data, at least 1024 bits of 
> entropy is left in the pool. I.e. all entropy above that point is available 
> for this request type. Note, even namespaces fall into this category 
> considering that unprivileged users can create a user name space in which they 
> can become root.

This doesn’t solve the problem. If two different users run stupid programs like gnupg, they will starve each other.

As I see it, there are two major problems with /dev/random right now: it’s prone to DoS (i.e. starvation, malicious or otherwise), and, because no privilege is required, it’s prone to misuse. Gnupg is misuse, full stop. If we add a new unprivileged interface, gnupg and similar programs will use it, and we lose all over again.