linux-kernel - Re: [PATCH v43 01/15] Linux Random Number Generator

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <fcd3a0f9-0228-4b4a-b425-a7438acef3b9@www.fastmail.com>
Date:   Tue, 11 Jan 2022 07:10:18 -0800
From:   "Andy Lutomirski" <luto@...nel.org>
To:     "Jason A. Donenfeld" <Jason@...c4.com>
Cc:     "Theodore Ts'o" <tytso@....edu>,
        "Marcelo Henrique Cerri" <marcelo.cerri@...onical.com>,
        "Simo Sorce" <simo@...hat.com>,
        "Greg Kroah-Hartman" <gregkh@...uxfoundation.org>,
        "Jeffrey Walton" <noloader@...il.com>,
        "Stephan Mueller" <smueller@...onox.de>,
        "Linux Crypto Mailing List" <linux-crypto@...r.kernel.org>,
        "Willy Tarreau" <w@....eu>, "Nicolai Stange" <nstange@...e.de>,
        "Linux Kernel Mailing List" <linux-kernel@...r.kernel.org>,
        "Arnd Bergmann" <arnd@...db.de>,
        "Eric W. Biederman" <ebiederm@...ssion.com>,
        "Alexander E. Patrakov" <patrakov@...il.com>,
        "Ahmed S. Darwish" <darwish.07@...il.com>,
        "Matthew Garrett" <mjg59@...f.ucam.org>,
        "Vito Caputo" <vcaputo@...garu.com>,
        "Andreas Dilger" <adilger.kernel@...ger.ca>,
        "Jan Kara" <jack@...e.cz>, "Ray Strode" <rstrode@...hat.com>,
        "William Jon McCann" <mccann@....edu>,
        zhangjs <zachary@...shancloud.com>,
        "Florian Weimer" <fweimer@...hat.com>,
        "Lennart Poettering" <mzxreary@...inter.de>,
        "Peter Matthias" <matthias.peter@....bund.de>,
        "Neil Horman" <nhorman@...hat.com>,
        "Randy Dunlap" <rdunlap@...radead.org>,
        "Julia Lawall" <julia.lawall@...ia.fr>,
        "Dan Carpenter" <dan.carpenter@...cle.com>,
        "Andy Lavr" <andy.lavr@...il.com>,
        "Petr Tesarik" <ptesarik@...e.cz>,
        "John Haxby" <john.haxby@...cle.com>,
        "Alexander Lobakin" <alobakin@...lbox.org>,
        "Jirka Hladky" <jhladky@...hat.com>,
        "Eric Biggers" <ebiggers@...nel.org>
Subject: Re: [PATCH v43 01/15] Linux Random Number Generator



On Tue, Jan 11, 2022, at 5:06 AM, Jason A. Donenfeld wrote:
> Hi Andy,
>
> On Tue, Jan 11, 2022 at 2:44 AM Andy Lutomirski <luto@...nel.org> wrote:
>> So let’s solve it for real.  Have a driver (in a module) that
>
> Um, let's not. This really isn't something the kernel needs to solve
> here at all. There's a viable userspace solution. I see that the
> discussion of something finally slightly technical (as opposed to just
> compliance BS) has nerd sniped you a bit, but keep in mind what the
> actual overall picture is. This isn't something that needs to be done.
> My little CUSE thing (which I'm happy to develop out a bit more, even)
> has the intent of fulfilling a compliance checkbox and nothing more.
>


Can you develop your CUSE thing enough that it’s credibly safe against side channels?  If so, fine.

I admit this is all rather absurd. FIPS aware userspace can do whatever it wants, and
It should be aware that /dev/urandom IS NOT FIPS.  What’s the problem?  rand(3) isn’t FIPS either, but no one puts person-years of effort into trying to paint it FIPS-colored