There are a number of things wrong with this post, but I'll respond in detail when I get to a keyboard.
On March 26, 2014 6:11:53 PM PDT, Andy Lutomirski <l...@amacapital.net> wrote: >[cc: Greg Price, might be working on this stuff] > >On Wed, Mar 26, 2014 at 6:03 PM, H. Peter Anvin <h...@zytor.com> wrote: >> I'm wondering more about the default. We default to 50% for >arch_get_random_seed, and this is supposed to be the default for in >effect unverified hwrngs... > >TBH I'm highly skeptical of this kind of entropy estimation. >/dev/random is IMO just silly, since you need to have very >conservative entropy estimates for the concept to really work, and >that ends up being hideously slow. Also, in the /dev/random sense, >most hardware RNGs have no entropy at all, since they're likely to be >FIPS-approved DRBGs that don't have a real non-deterministic source. > >For the kernel's RNG to be secure, I think it should have the property >that it still works if you rescale all the entropy estimates by any >constant that's decently close to 1. > >If entropy estimates are systematically too low, then a naive >implementation results in an excessively long window during early >bootup in which /dev/urandom is completely insecure. > >If entropy estimates are systematically too high, then a naive >implementation fails to do a catastrophic reseed, and the RNG can be >brute-forced. > >So I think that the core code should do something along the lines of >using progressively larger reseeds. Since I think that /dev/random is >silly, this means that we only really care about the extent to which >"entropy" measures entropy conditioned on whatever an attacker can >actually compute. Since this could vary widely between devices (e.g. >if your TPM is malicious), I think that the best we can do is to >collect ~256 bits from everything available, shove it all in to the >core together, and repeat. For all I know, the core code already does >this. > >The upshot is that the actual rescaling factor should barely matter. >50% is probably fine. So is 100% and 25%. 10% is probably asking for >trouble during early boot if all you have is a TPM. > >--Andy -- Sent from my mobile phone. Please pardon brevity and lack of formatting. -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
