Re: [PATCH] random: add random_initialized command line param

[Stephan Mueller <smueller@chronox.de>]

Am Mittwoch, 20. Mai 2015, 11:06:42 schrieb Theodore Ts'o:

Hi Theodore,

As a side note to this discussion, may I ask why entropy_total is used for 
checking against the threshold value and not entropy_count?

The reason for my question is the following: until a DRNG (in the worst case, 
nonblocking_pool is a DRNG) is fully seeded, partial seeds may be "eaten" up 
by the caller.

For the discussion, let us assume the worst case that there is coming in one 
bit of entropy at a time. In between the addition of each bit of entropy, an 
attacker can access the DRNG (i.e. the SHA1 output of the nonblocking_pool). 
When only one bit of entropy is added to the nonblocking_pool, the attack 
complexity would be 1 bit. When an attacker would access the nonblocking_pool 
after each received bit, in the worst case, the attack complexity is not 
2**128 but rather 256 (i.e. 1 bit for each individual attack between the 
addition of one new bit of entropy).

So, the total attack complexity is the sum of the individual attack 
complexities (i.e. the complexity added after the previous attack is 
performed).

When using the entropy_count variable which is affected by account() (i.e. it 
is decreased when a reader obtains data), the threshold is only reached when 
truly 128 unobserved bits are collected.

Ciao
Stephan