Re: [PATCH,RFC] random: collect cpu randomness

["H. Peter Anvin" <hpa@zytor.com>]

On 02/02/2014 05:24 PM, Jörn Engel wrote:
> 
> For my part, I think the whole business of estimating entropy is
> bordering on the esoteric.  If the hash on the output side is any
> good, you have a completely unpredictable prng once the entropy pool
> is unpredictable.  Additional random bits are nice, but not all that
> useful.  Blocking /dev/random based on entropy estimates is likewise
> not all that useful.
> 
> Key phrase is "once the entropy pool is unpredictable".  So early in
> bootup it may make sense to estimate the entropy.  But here the
> problem is that you cannot measure entropy, at least not within a
> single system and a reasonable amount of time.  That leaves you with a
> heuristic that, like all heuristics, is wrong.
> 

The entropy bound needs to be a conservative lower bound.  Its main use
is to provide backpressure (should we spend more CPU time producing
entropy) although the forward pressure on /dev/random is potentially
useful for high security applications.

This does NOT mean that zero-credit entropy generation is useless, far
from it.  It just means that we are doing it on an "it can't hurt"
basis, rather than "I know for sure that this is valuable."

	-hpa