linux-kernel - RE: [PATCH] random: allow writes to /dev/urandom to influence fast init

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <6716f3ffefae4ed8b5fd332bfcca8a9a@AcuMS.aculab.com>
Date:   Wed, 23 Mar 2022 02:15:55 +0000
From:   David Laight <David.Laight@...LAB.COM>
To:     "'Jason A. Donenfeld'" <Jason@...c4.com>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "linux-crypto@...r.kernel.org" <linux-crypto@...r.kernel.org>
CC:     Linus Torvalds <torvalds@...ux-foundation.org>,
        Guenter Roeck <linux@...ck-us.net>,
        Dominik Brodowski <linux@...inikbrodowski.net>,
        Theodore Ts'o <tytso@....edu>, Jann Horn <jannh@...gle.com>
Subject: RE: [PATCH] random: allow writes to /dev/urandom to influence fast
 init

From: Jason A. Donenfeld
> Sent: 22 March 2022 19:15
> 
> For as far back as I can tell, writing to /dev/urandom or /dev/random
> will put entropy into the pool, but won't immediately use it, and won't
> credit it either. Instead, crediting is controlled by the ioctls
> RNDADDTOENTCNT and RNDADDENTROPY. If, however, this happens during early
> boot before the input pool is ready, we have a dangerous situation with
> seed files as commonly used by shell scripts:
> 
>   dd if=seedfile of=/dev/urandom # write seed into pool
>   dd if=/dev/urandom of=seedfile count=1 bs=32 # read new seed for next boot
> 
> Since the entropy in seedfile isn't credited there, this won't cause the
> RNG to transition from crng_init=0 to crng_init=2, and so when we make a
> new seedfile for next boot, we'll still be getting crng_init=0-quality
> randomness, which may well regress from the original seedfile.

Never mind scripts that try to immediately save a new seedfile [1].

What about code run by later startup scripts that wants random numbers.
They really do want the seedfile data to be used.
If it isn't used then they are likely to get very weak random numbers.

You can't really expect startup scripts to be issuing ioctl requests.

[1] I suspect the initial 'save' is just there to ensure that the
random numbers don't exactly repeat if the system crashes.
The seedfile will be written again during normal shutdown.


	David

-
Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK
Registration No: 1397386 (Wales)