|
|
Subscribe / Log in / New account

Fixing getrandom()

Fixing getrandom()

Posted Sep 28, 2019 9:57 UTC (Sat) by dd9jn (✭ supporter ✭, #4459)
Parent article: Fixing getrandom()

So in Libgcrypt we have been urged to move to getrandom to avoid some issues in the early boot phase and to get better performance in almost all cases. Weakening getrandowm now is a no-go and would badly reflect on the security consciousness of _some_ kernel folks.

Using Stephan Müller's jitter based entropy generator inside the kernel is by any means the Right Thing to do - even if it is for now only a fallback. In Libgcrypt's Windows version we already use it because on Windows the JitterRNG is the only non-external-hardware RNG which has been approved by Germany's BSI for use in restricted communication at the VS-NfD level. On Linux getrandom has been evaluated as fine but nevertheless we mix some entropy from the JitterRNG into our own entropy pool. Right, we also use RDRAND in addition and that is technically okay. But because RDRAND can't be evaluated the evaluation of Libgcrypt assumes that RDRAND adds 0 bits of entropy to the pool.


to post comments

Fixing getrandom()

Posted Sep 28, 2019 19:52 UTC (Sat) by patrakov (subscriber, #97174) [Link] (2 responses)

Could you please submit some documental evidence of this approval? Asking because it would be the perfect response to the last paragraph in https://lore.kernel.org/lkml/CAHk-=whz7Okts01ygAP6GZWBvCV...

Fixing getrandom()

Posted Sep 28, 2019 20:38 UTC (Sat) by joib (subscriber, #8541) [Link]

Probably the BSI cares only about x86(-64) Windows on cpu's supported by currently maintained Windows versions, so they can assume the presence of TSC? So it doesn't really address what seemed to be Linus main objection.

(Though in my non-expert opinion, it seems having a jitter entropy generator in the kernel for supported targets would be the least bad approach of those discussed here. Those few that run unsupported targets are hopefully sufficiently clueful that they can use a hw RNG, haveged, or maybe they don't need early boot random numbers anyway.)

Fixing getrandom()

Posted Oct 2, 2019 0:54 UTC (Wed) by mangix (guest, #126006) [Link]

FWIW OpenWrt master (and 19.07) uses this. It's faster than haveged.


Copyright © 2025, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds