From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 1AB97C433EF for ; Wed, 6 Jul 2022 00:30:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:In-Reply-To:MIME-Version:References: Message-ID:Subject:Cc:To:From:Date:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=/ycPDZJQdOPlJD7JXiu/Vez6AnFLHujGYerXh+ZPdMY=; b=pX3utM9LcbQiLs L2kfQNn4fZ0sWbfL1ZaNakr38jsxwwsbXVJ8ece5zJQDV6+6q+Qs/zqBJkIrn4Uwb8luDscitQh0p UL0pmxrNrTbYvk1+Y1JQnGRDiXuMTs8W5Rc1GjELu6XuVf5Lx5MVS61RM/L0meLM2+GuHz9/btxSL CLwBC1liNP8pDHKqqxyySzbgfLPJhUMq2aaAS1oLnm9y1RjnBwQcjjoRrTJAYc4ax2tzaQH6aqAKi aTSBYOqJpY3lZVusmB6mMjkPHvSQcLjnsjfIgFjQhvsPCOgrRZx2BLCBtRqqLNwM7ASKqdpBa1jko FI1LJz60J2BwEVyASSaQ==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1o8suB-0056sI-1u; Wed, 06 Jul 2022 00:28:35 +0000 Received: from dfw.source.kernel.org ([2604:1380:4641:c500::1]) by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux)) id 1o8su7-0056r3-Pi for linux-arm-kernel@lists.infradead.org; Wed, 06 Jul 2022 00:28:33 +0000 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 0C72A61274; Wed, 6 Jul 2022 00:28:28 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B0E8CC341C7; Wed, 6 Jul 2022 00:28:25 +0000 (UTC) Authentication-Results: smtp.kernel.org; dkim=pass (1024-bit key) header.d=zx2c4.com header.i=@zx2c4.com header.b="ihc73PJ/" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=zx2c4.com; s=20210105; t=1657067303; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=OhugZvecg+oWrbxbccQQJUXAAF4kA6okY4PhlziPCHY=; b=ihc73PJ/0bSh+zgqGgWeUk/Hm5AVBfEF9wPhoIjfU6IXnQq0Evw5IV7MV7pFn+utADjqHU tLwFQa5KqWiwPoKWLREPMkkWzzzxJ/PRlWSblvPAqtP7Fx5tJ5pUAASWYy8W5Va7qsfJ9l a9mKSh5Snj6sDzvYSnoQdLykd2A6bMg= Received: by mail.zx2c4.com (ZX2C4 Mail Server) with ESMTPSA id 53f900aa (TLSv1.3:AEAD-AES256-GCM-SHA384:256:NO); Wed, 6 Jul 2022 00:28:23 +0000 (UTC) Date: Wed, 6 Jul 2022 02:28:19 +0200 From: "Jason A. Donenfeld" To: "H. Peter Anvin" Cc: Borislav Petkov , linux-arm-kernel@lists.infradead.org, linuxppc-dev@lists.ozlabs.org, linux-s390@vger.kernel.org, linux-kernel@vger.kernel.org, x86@kernel.org, Catalin Marinas , Will Deacon , Michael Ellerman , Heiko Carstens , Alexander Gordeev , Thomas Gleixner , Greg Kroah-Hartman , Arnd Bergmann Subject: Re: [PATCH] random: remove CONFIG_ARCH_RANDOM and "nordrand" Message-ID: References: <20220705190121.293703-1-Jason@zx2c4.com> <11C903CC-22A7-48EE-AD63-E71CC8D28B88@zytor.com> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <11C903CC-22A7-48EE-AD63-E71CC8D28B88@zytor.com> X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20220705_172832_168291_A60440B6 X-CRM114-Status: GOOD ( 35.60 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org Hi Borislav, Peter, On Tue, Jul 05, 2022 at 02:50:34PM -0700, H. Peter Anvin wrote: > On July 5, 2022 12:57:04 PM PDT, Borislav Petkov wrote: > >On Tue, Jul 05, 2022 at 09:44:17PM +0200, Jason A. Donenfeld wrote: > >> Oh, huh. Maybe in that case I should adjust the message to say "consider > >> using `random.trust_cpu=0`," which is the thing that would actually make > >> a security difference. > > > >Why isn't that option documented in > >Documentation/admin-guide/kernel-parameters.txt? Maybe you're not grepping the right tree? zx2c4@thinkpad ~/Projects/random-linux $ grep trust_cpu Documentation/admin-guide/kernel-parameters.txt random.trust_cpu={on,off} https://git.kernel.org/pub/scm/linux/kernel/git/crng/random.git/tree/Documentation/admin-guide/kernel-parameters.txt#n4506 > >> But actually, one thing that wasn't clear to me was: does `nordrand` > >> affect what userspace sees? While random.c is okay in lots of > >> circumstances, I could imagine `nordrand` playing a role in preventing > >> userspace from using it, which might be desirable. Is this the case? If > >> so, I can remove the nordrand chunk from this patch for v2. If not, I'll > >> adjust the text to mention `random.trust_cpu=0`. > > > >Unfortunately, it doesn't disable the instruction. It would be lovely if > >we had a switch like that... > > > >That's why this message is supposed to be noisy so that people can pay > >attention at least. I was wondering if it somehow removed it from cpuid. But I guess that's not possible. So okay, no real userspace effect. I think I agree with you then: > >> In the sense that random.c can handle mostly any input without making > >> the quality worse. So, you can't accidentally taint it. The only risk is > >> if it thinks RDRAND is good and trustable when it isn't, but that's what > >> `random.trust_cpu=0` is for. > > > >And that's why I'm saying that if you detect RDRAND returning the > >same thing over and over again, you should simply stop using it. > >Automatically. Not rely on the user to do anything. > > > > It's just math. The only variable is your confidence level, i.e. at > what level do you decide that the likelihood of pure chance is way > smaller than the likelihood of hardware failure. For example, the > likelihood of m n-bit samples in a row being identical is > 2^-(n*(m-3/2)), and the likelihood of the CPU being destroyed by a > meterorite in the same microsecond is about 2^-100. I think I'm on board with that general plan of adding a little online selftest that's better than what's there now and using that to get rid of nordrand. I don't want to instrument every invocation like you suggested, because this has effects on forward secrecy (e.g. it's nice to burn previous results from memory). But doing a little test at boot up better than what we have now seems like a good idea. So let's do this - I'll send a v2 changing this patch to be a bit more boring and just get rid of CONFIG_ARCH_RANDOM. That'll be straight forward. And then Peter - do you want to take a stab at doing the selftest in order to get rid of nordrand? Or would you prefer I try? It sounds like you have a specific idea of what you'd like there, so maybe that's best? For now, v2 of this patch sans nordrand is incoming shortly. Jason _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel