On Fri, Aug 24, 2012 at 04:40:28PM +0200, Heinz Diehl wrote: > On 24.08.2012, Milan Broz wrote: > > > There is currently a lot of effort to ensure that /dev/urandom > > cannot produce weak data even in extreme situations. > > I'm more than happy that Intels hardware RNG isn't used as the only > source for randomness on systems where it is available (as proposed by > Linus himself). > > https://patchwork.kernel.org/patch/1161881/ I agree. I think Linux does not quite understand the issue here. If some Intel chips are compromised, nothing but a very expensive hardware analysis or a massive intelligence blunder would reveal that, hence it is very, very unlikely for Intel (or any other CPU maker) to get caught red-handed. On the other hand, mixing in a reasonable amount of other randomness negates any attack possibilities via the HW RNG and at the same time allows it to be used as high-quality "stretching" material. For example, using 512 bits of other entropy and stretch this to a few MB with the HW RNG would still be fine (if done right) even if the HW RNG is compromised. The solurtion by Tso makes perfect sense cryptographically and from a risk-management perspective. Never put all your eggs in one basket unless there really is no other choice. Arno -- Arno Wagner, Dr. sc. techn., Dipl. Inform., Email: arno@xxxxxxxxxxx GnuPG: ID: 1E25338F FP: 0C30 5782 9D93 F785 E79C 0296 797F 6B50 1E25 338F ---- One of the painful things about our time is that those who feel certainty are stupid, and those with any imagination and understanding are filled with doubt and indecision. -- Bertrand Russell _______________________________________________ dm-crypt mailing list dm-crypt@xxxxxxxx http://www.saout.de/mailman/listinfo/dm-crypt
