From: Jason A. Donenfeld > Sent: 22 March 2022 19:15 > > For as far back as I can tell, writing to /dev/urandom or /dev/random > will put entropy into the pool, but won't immediately use it, and won't > credit it either. Instead, crediting is controlled by the ioctls > RNDADDTOENTCNT and RNDADDENTROPY. If, however, this happens during early > boot before the input pool is ready, we have a dangerous situation with > seed files as commonly used by shell scripts: > > dd if=seedfile of=/dev/urandom # write seed into pool > dd if=/dev/urandom of=seedfile count=1 bs=32 # read new seed for next boot > > Since the entropy in seedfile isn't credited there, this won't cause the > RNG to transition from crng_init=0 to crng_init=2, and so when we make a > new seedfile for next boot, we'll still be getting crng_init=0-quality > randomness, which may well regress from the original seedfile. Never mind scripts that try to immediately save a new seedfile [1]. What about code run by later startup scripts that wants random numbers. They really do want the seedfile data to be used. If it isn't used then they are likely to get very weak random numbers. You can't really expect startup scripts to be issuing ioctl requests. [1] I suspect the initial 'save' is just there to ensure that the random numbers don't exactly repeat if the system crashes. The seedfile will be written again during normal shutdown. David - Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK Registration No: 1397386 (Wales)
