Am Fri, Feb 04, 2022 at 02:53:23PM +0100 schrieb Jason A. Donenfeld: > Our pool is 256 bits, and we only ever use all of it or don't use it at > all, which is decided by whether or not it has 128 bits in it. So we can "has at least" > drastically simplify the accounting and cmpxchg loop to do exactly this. > While we're at it, we move the minimum bit size into a constant so it > can be shared between the two places where it matters. > > The reason we want any of this is for the case in which an attacker has > compromised the current state, and then bruteforces small amounts of > entropy added to it. By demanding a particular minimum amount of entropy > be present before reseeding, we make that bruteforcing difficult. > > Note that this rationale no longer includes anything about /dev/random > blocking at the right moment, since /dev/random no longer blocks (except > for at ~boot), but rather uses the crng. In a former life, /dev/random > was different and therefore required a more nuanced account(), but this > is no longer. > > Behaviorally, nothing changes here. This is just a simplification of > the code. > > Cc: Theodore Ts'o <tytso@xxxxxxx> > Cc: Dominik Brodowski <linux@xxxxxxxxxxxxxxxxxxxx> > Cc: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> > Signed-off-by: Jason A. Donenfeld <Jason@xxxxxxxxx> Reviewed-by: Dominik Brodowski <linux@xxxxxxxxxxxxxxxxxxxx> Thanks, Dominik
