Re: [PROPOSAL/PATCH] Fortuna PRNG in /dev/random

Jean-Luc Cooke
2004-09-28T02:25:31Z

On Mon, Sep 27, 2004 at 08:07:19PM -0400, Theodore Ts'o wrote:
> On Mon, Sep 27, 2004 at 03:45:02PM -0400, Jean-Luc Cooke wrote:
> > > Actually trying to replace the partial MD4 might be worth an attempt:
> > > I'm certain that the partial MD4 is not the best/fastest way to generate
> > > sequence numbers.
> >
> > It infact uses two full SHA1 hashs for tcp sequence numbers (endian and
> > padding issues aside). my patch aims to do this in 1 AES256 Encrypt or 2
> > AES256 encrypts for ipv6.
>
> No, that's not correct. We rekey once at most every five minutes, and
> that requires a SHA hash, but in the normal case, it's only a partial MD4.

Pardon, the SYN cookies use two SHA1's, not the TCP sequence numbers. Easy
to mistake to make with comments "Compute the secure sequence number." in the
secure_tcp_syn_cookie() function. :)

> An AES encrypt for every TCP connection *might* be faster, but I'd
> want to time it to make sure, and doing a bulk test ala "openssl
> speed" isn't necessarily going to be predictive, as I've discussed earlier.

Agreed.

Was meaning to ask:
add_timer_randomness()

There is a comment:
/* if over the trickle threshold, use only 1 in 4096 samples */
if ( random_state->entropy_count > trickle_thresh &&
(__get_cpu_var(trickle_count)++ & 0xfff))
return;

"if (x++ & 0xfff)" will return true 0xfff out of 0x1000 of the time. Is this
the goal, because I don't think this will trickle control very well.

JLC