From: Milan Broz <mbroz@redhat.com>
To: dm-crypt@saout.de
Subject: Re: [dm-crypt] Entropy available for luksFormat during GNU/Linux installs
Date: Mon, 25 Jan 2010 12:25:02 +0100 [thread overview]
Message-ID: <4B5D7F8E.1090202@redhat.com> (raw)
In-Reply-To: <20100124230354.GA24786@tansi.org>
On 01/25/2010 12:03 AM, Arno Wagner wrote:
> On Sun, Jan 24, 2010 at 03:02:05PM +0100, Heinz Diehl wrote:
>> On 24.01.2010, Arno Wagner wrote:
>>
>>> "As a general rule, /dev/urandom should be used for everything
>>> except long-lived GPG/SSL/SSH keys."
cryptsetup now depends on gcrypt, I will probably rewrite random source
to use gcrypt random generators
(its RNG can use both /dev/random and /dev/urandom for seeding)
In LUKS case, there are four places which need random data:
- volume (master) key generation
- volume key digest salt and password salt
- anti-forensic split for keyslot obfuscation
- safe wipe
we are talking only only the first (master key) case here, right?
Any known problem why not to use gcrypt RNG?
(It should internally wrap possible waiting for enugh entropy,
FIPS mode etc. No need to duplicate code in cryptsetup.)
Milan
next prev parent reply other threads:[~2010-01-25 11:25 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2010-01-24 6:17 [dm-crypt] Entropy available for luksFormat during GNU/Linux installs Roscoe
2010-01-24 10:50 ` Milan Broz
2010-01-24 13:11 ` Arno Wagner
2010-01-24 14:02 ` Heinz Diehl
2010-01-24 14:31 ` Rick Moritz
2010-01-24 16:56 ` Heinz Diehl
2010-01-24 23:11 ` Arno Wagner
2010-01-24 23:03 ` Arno Wagner
2010-01-25 11:25 ` Milan Broz [this message]
2010-02-03 0:45 ` Roscoe
2010-02-03 6:21 ` Arno Wagner
2010-02-03 7:57 ` Arno Wagner
2010-02-03 12:31 ` Roscoe
2010-02-03 8:56 ` Milan Broz
[not found] ` <cf657bae1002030430l3b0f4768x19e917466b5664bb@mail.gmail.com>
[not found] ` <4B697D55.5020304@redhat.com>
[not found] ` <cf657bae1002031231s6dd17c8bq118e5c5276c31b84@mail.gmail.com>
2010-03-23 8:43 ` Roscoe
-- strict thread matches above, loose matches on Subject: below --
2010-01-24 18:12 Si St
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4B5D7F8E.1090202@redhat.com \
--to=mbroz@redhat.com \
--cc=dm-crypt@saout.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox