From: Stephan Mueller <smueller@chronox.de>
To: "Theodore Ts'o" <tytso@mit.edu>
Cc: "Jörn Engel" <joern@logfs.org>,
"John Stultz" <john.stultz@linaro.org>,
LKML <linux-kernel@vger.kernel.org>,
dave.taht@bufferbloat.net,
"Frederic Weisbecker" <fweisbec@gmail.com>,
"Thomas Gleixner" <tglx@linutronix.de>
Subject: Re: [PATCH] /dev/random: Insufficient of entropy on many architectures
Date: Sun, 15 Sep 2013 13:12:15 +0200 [thread overview]
Message-ID: <3242570.OlG8jyNm4p@tauon> (raw)
In-Reply-To: <20130913185931.GB15366@thunk.org>
Am Freitag, 13. September 2013, 14:59:31 schrieb Theodore Ts'o:
Hi Theodore,
>On Fri, Sep 13, 2013 at 07:36:20AM +0200, Stephan Mueller wrote:
>
>However, if you are worried about a malicious entropy source, things
>are a little bit different. Suppose RDRAND == AES(i++, NSA_KEY),
>where the NSA doesn't know the starting value of i. But if it get can
>get a raw RDRAND value (say, someone uses it without doing any
>whitening as a session key or as a D-H parameter), it can decrypt the
>output using the NSA_KEY, and then now that it knows i, it can brute
>force break the RDRAND output, even if it's not entirely sure how many
>times RDRAND has been called between that cleanb RDRAND value and the
>RDRAND output it is trying to break.
>
>In *this* case, smearing out the value of RDRAND across the entropy
>pool does help, becuase it makes it significantly harder to get a
>clean RDRAND value to decrypt.
Agreed. I was only talking about "well-behaved" entropy sources.
>
>
>That being said, the much bigger problem that I'm worried about is not
>necessarily a trojan'ed RDRAND, but rather on embedded ARM and MIPS
>devices where we have unsufficient entropy, and on the first boot out
>of the box, there is no random seed file that can be fixed in at boot
Yes, my local MIPS-based router which is a very ubiquitous one in
Germany (Fritz Box) does not seed /dev/random but yet starts using
/dev/urandom during boot cycle.
>time. Mixing in personalization information (serial numbers, MAC
>addresses) which *hopefully* the NSA wouldn't know in the case of
>pervasive, bulk surveillance, is a bit of a help. But it's certainly
>no help against a direct, targetted attack.
That is why I am hoping that the CPU jitter as harvested by my RNG will
help as it delivers entropy on demand in a bandwidth where the initial
seeding may not needed any more and we have sufficient entropy during
boot sequence.
>
>Regards,
>
> - Ted
Ciao
Stephan
prev parent reply other threads:[~2013-09-15 11:12 UTC|newest]
Thread overview: 58+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-09-10 11:31 [PATCH] /dev/random: Insufficient of entropy on many architectures Stephan Mueller
2013-09-10 11:46 ` Geert Uytterhoeven
2013-09-10 15:04 ` Theodore Ts'o
2013-09-10 16:54 ` Stephan Mueller
2013-09-10 18:25 ` Theodore Ts'o
2013-09-10 19:15 ` Stephan Mueller
2013-10-10 6:50 ` Pavel Machek
2013-10-14 21:13 ` Theodore Ts'o
2013-09-10 20:48 ` Geert Uytterhoeven
2013-09-10 21:14 ` Theodore Ts'o
2013-09-11 6:49 ` Stephan Mueller
2013-09-12 11:59 ` Geert Uytterhoeven
2013-09-12 12:08 ` Stephan Mueller
2013-09-12 12:15 ` Geert Uytterhoeven
2013-09-12 12:35 ` Stephan Mueller
2013-09-12 12:47 ` Geert Uytterhoeven
2013-09-12 12:57 ` Stephan Mueller
2013-09-12 21:18 ` Jörn Engel
2013-09-13 11:33 ` Thorsten Glaser
2013-09-12 14:25 ` Theodore Ts'o
2013-09-10 19:38 ` John Stultz
2013-09-10 19:44 ` John Stultz
2013-09-10 19:47 ` Stephan Mueller
2013-09-10 20:35 ` John Stultz
2013-09-10 20:38 ` Theodore Ts'o
2013-09-10 20:46 ` John Stultz
2013-09-10 21:10 ` Theodore Ts'o
2013-09-10 22:08 ` John Stultz
2013-09-10 22:33 ` Theodore Ts'o
2013-09-11 0:31 ` John Stultz
2013-09-11 0:50 ` Theodore Ts'o
2013-09-11 1:14 ` John Stultz
2013-09-12 20:46 ` H. Peter Anvin
2013-09-12 21:07 ` Jörn Engel
2013-09-12 23:31 ` Theodore Ts'o
2013-09-12 23:35 ` Jörn Engel
2013-09-13 0:00 ` Jörn Engel
2013-09-16 15:40 ` [PATCH,RFC] random: make fast_mix() honor its name Jörn Engel
2013-09-21 21:25 ` Theodore Ts'o
2013-09-21 21:41 ` Theodore Ts'o
2013-09-22 3:05 ` Theodore Ts'o
2013-09-22 21:01 ` Jörg-Volker Peetz
2013-09-22 21:27 ` Theodore Ts'o
2013-09-22 20:53 ` Jörn Engel
2013-09-22 23:36 ` Theodore Ts'o
2013-09-23 0:16 ` Jörn Engel
2013-09-23 2:43 ` Theodore Ts'o
2013-09-23 15:02 ` Jörn Engel
2013-09-23 7:39 ` Jörg-Volker Peetz
2013-09-22 20:31 ` Jörn Engel
2013-09-22 20:14 ` Jörn Engel
2013-09-12 21:31 ` [PATCH] /dev/random: Insufficient of entropy on many architectures Jörn Engel
2013-09-13 5:36 ` Stephan Mueller
2013-09-13 11:54 ` Thorsten Glaser
2013-09-13 19:29 ` Theodore Ts'o
2013-09-13 15:26 ` Jörn Engel
2013-09-13 18:59 ` Theodore Ts'o
2013-09-15 11:12 ` Stephan Mueller [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=3242570.OlG8jyNm4p@tauon \
--to=smueller@chronox.de \
--cc=dave.taht@bufferbloat.net \
--cc=fweisbec@gmail.com \
--cc=joern@logfs.org \
--cc=john.stultz@linaro.org \
--cc=linux-kernel@vger.kernel.org \
--cc=tglx@linutronix.de \
--cc=tytso@mit.edu \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox