Re: [PATCH 1/2] random: Add support for architectural random hooks

["Ted Ts'o" <tytso@mit.edu>]

On Sat, Jul 30, 2011 at 09:29:18AM -1000, Linus Torvalds wrote:
> The fact is, even if you worry about some back door for the NSA, or
> some theoretical lack of perfect 32-bit randomness, we can pretty much
> depend on it. We still do our own hashing on top of whatever entropy
> we get out of rdrand, and we would still have all our other stuff.
> Plus the instruction is public and testable - if Intel did something
> wrong, they'll be *very* embarrassed.

Technically speaking, if Intel and the NSA were colluding together in
a competent way, we'd never know; it's not something that could be
tested.  Intel could have implemented a incrementing counter which was
initialized to some randomness, which was then encrypted by some NSA
secret algorithm with a secret key known only to the NSA.  We'd never
know, but it would be enough of a backdoor for the NSA to do what they
need to know.  The only way it could leak out is via the human
channel; if someone was upset enough about it that they send the
algorithm and secret key to wikileaks.

But yeah, we can definitely depend on it if it is hashed into the pool
and it's on top of everything else that we do.  And it's all a matter
of how paranoid you want to be.  If you are working for government,
where the NSA is by definition one of the good guys, then using rdrand
directly is completely not a problem.  If you are working for any
other government agency, you'd probably want to mix it into the a
random pool just to feel better about implicitly trusting Intel.

So I agree with Linus here.

						- Ted