On Thu, Jun 23, 2016 at 12:45 PM, Sandy Harris <sandyinch...@gmail.com> wrote: > Jason Cooper <ja...@lakedaemon.net> wrote: > >> Modern systems that receive a seed from the bootloader via the >> random-seed property (typically from the hw-rng) can mix both sources >> for increased resilience. >> >> Unfortunately, I'm not very familiar with the internals of x86 >> bootstrapping. Could GRUB be scripted to do a similar task? How would >> the address and size of the seed be passed to the kernel? command line? > > One suggestion is at: > http://www.av8n.com/computer/htm/secure-random.htm#sec-boot-image
Interesting! This might pose a problem for signed images, though. (Actually, for signed arm kernels is the DT signed too? If so, it would be a similar problem.) -Kees -- Kees Cook Chrome OS & Brillo Security
