Re: [PATCH] get_random_bytes returns the same on every boot

[Jack Lloyd <lloyd@randombit.net>]

On Mon, Aug 02, 2004 at 10:42:17PM +0000, David Wagner wrote:
> Balint Marton  wrote:
> >At boot time, get_random_bytes always returns the same random data, as if
> >there were a constant random seed.  [This is because no entropy is
> >available yet.]
> 
> Are there any consequences of this for security?  A number of network
> functions call get_random_bytes() to get unguessable numbers; if those
> numbers are guessable, security might be compromised.  Note that most init
> scripts save randomness state from the last reboot and fill it into the
> entropy pool after boot, but before then any callers to get_random_bytes()
> might be vulnerable.  Has anyone ever audited all places that call
> get_random_bytes() to see if any of them might pose a security exposure
> during the window of time between boot and execution of init scripts?
> For instance, are TCP sequence numbers, SYN cookies, etc. vulnerable?

If the init scripts haven't run, then most likely your machine doesn't have an
IP address configured anyway. On some distros the network is configured before
the saved entropy is added to the pool, but most servers don't get started
until afterward.

> (Needless to say, seeding the pool with just the time of day and the
> system hostname is not enough to defend against such attacks.)

I can't think of much else the machine could be adding at the point before init
is created. The TSC isn't going to be very unpredicable, since the machine just
booted, but it might have a few bits of entropy. Hardware serial numbers?
Fixed, and largely easy to get ahold of. I'm out of ideas.

Hmmm, it just occured to me that you could include process execution details
(owner, pathname, pid/ppid, timestamp) into the entropy pool, sort of like a
Cryptlib generator but in kernel space. But again, that isn't of much use
before the kernel creates init.

-Jack