On Tue, Jul 18, 2017 at 5:08 PM, Theodore Ts'o <tytso@xxxxxxx> wrote: > I've been trying to take the best features and suggestions from your > proposal and integrating them into /dev/random already. A good approach. > Things that I've chosen not take is basically because I disbelieve > that the Jitter RNG is valid. ... The biggest problem with random(4) is that you cannot generate good output without a good seed & just after boot, especially first boot on a new system, you may not have enough entropy. A user space process cannot do it soon enough and all the in-kernel solutions (unless you have a hardware RNG) pose difficulties. The only really good solution I know of is to find a way to provide a chunk of randomness early in the boot process. John Denker has a good discussion of doing this by modifying the kernel image & Ted talks of doing it via the boot loader. Neither looks remarkably easy. Other approaches like making the kernel read a seed file or passing a parameter on the kernel command line have been suggested but, if I recall right, rejected. As I see it, the questions about Jitter, or any other in-kernel generator based on timing, are whether it is good enough to be useful until we have one of the above solutions or useful as a defense-in-depth trick after we have one. I'd say yes to both. There's been a lot of analysis. Stephan has a detailed rationale & a lot of test data in his papers & the Havege papers also discuss getting entropy from timer operations. I'd say the best paper is McGuire et al: https://static.lwn.net/images/conf/rtlws11/random-hardware.pdf There is enough there to convince me that grabbing some (256?) bits from such a generator early in the initialization is worthwhile. > So I have been trying to do the evolution thing already. > ... > I'm obviously biased, but I don't see I see the Raison d'Etre for > merging LRNG into the kernel. Nor I.
