Re: [dm-crypt] miscellaneous dm-crypt/LUKS/cryptsetup questions

[Milan Broz <mbroz@redhat.com>]

On 05/28/2010 09:39 AM, Mario 'BitKoenig' Holbe wrote:
> Arno Wagner <arno@wagner.name> wrote:
>> However that does not solve the case of automatic installation
>> on, e.g., embedded devices that have a low-entropy envoronment.
> 
> well, such install-systems could have a look at the entropy available
> before choosing a specific source of randomness (not that there would be
> a good one on such systems :)).

Various systems (installed from net/PXE) which have enough entropy to
generate master key for LUKS disk (or at least to properly seed some pseudo RNG),
have not enough entropy to seed gcrypt very-strong-RNG
(it _requires_ 300 bytes /dev/random data to seed).

And because the system is usually headless, waiting in installer/luksFormat
with possible no network activity at the moment, it can wait forever.

(My example was about some install verification system, where
the quality of the long term key was not important. Everyone probably
see here possible problem with not enough entropy in generated
key in general in such installations...)

Milan