Re: [RFC][PATCH] Make cryptoapi non-optional?

Matt Mackall
2003-08-16T04:57:14Z

On Sat, Aug 16, 2003 at 01:58:07AM +0100, Jamie Lokier wrote:
> Andrew Morton wrote:
> > Matt Mackall <mpm@selenic.com> wrote:
> > > I'm pretty sure there was never a time when entropy
> > > accounting wasn't racy let alone wrong, SMP or no (fixed in -mm, thank
> > > you).
> >
> > Well is has been argued that the lack of locking in the random driver is a
> > "feature", adding a little more unpredictability.
>
> Dodgy. Does lack of locking mean users can trick /dev/random into
> thinking it has more entropy than it does? Or let them detect the
> time when /dev/random gains entropy, without reading it?

Yes to the first, detailed at great length in a separate message. You
can do timing attacks on the inputs either way. I'll repost my fix for
it eventually, it's low on the list.

> > Now I don't know if that makes sense or not, but the locking certainly has
> > a cost. If it doesn't actually fix anything then that cost becomes a
> > waste.
>
> Per-cpu random pools, perhaps :)

I really doubt contention here is significant, but will take about ten
lines to address if these locks ever show up on someone's Specweb
benchmark.

--
Matt Mackall : http://www.selenic.com : of or relating to the moon