On Mon, Sep 16, 2019 at 01:21:17PM -0400, Theodore Y. Ts'o wrote:
> On Mon, Sep 16, 2019 at 09:17:10AM -0700, Linus Torvalds wrote:
> > So the semantics that getrandom() should have had are:
> >
> > getrandom(0) - just give me reasonable random numbers for any of a
> > million non-strict-long-term-security use (ie the old urandom)
> >
> > - the nonblocking flag makes no sense here and would be a no-op
>
> That change is what I consider highly problematic. There are a *huge*
> number of applications which use cryptography which assumes that
> getrandom(0) means, "I'm guaranteed to get something safe
> cryptographic use". Changing his now would expose a very large number
> of applications to be insecure. Part of the problem here is that
> there are many different actors. There is the application or
> cryptographic library developer, who may want to be sure they have
> cryptographically secure random numbers. They are the ones who will
> select getrandom(0).
>
> Then you have the distribution or consumer-grade electronics
> developers who may choose to run them too early in some init script or
> systemd unit files. And some of these people may do something stupid,
> like run things too early, or omit the a hardware random number
> generator in their design, even though it's for a security critical
> purpose (say, a digital wallet for bitcoin).
Ted, you're really the expert here. My apologies though, every time I
see the words "too early" I get a cramp... Please check my earlier
reply:
https://lkml.kernel.org/r/20190912034421.GA2085@darwi-home-pc
Specifically the trace_printk log of all the getrandom(2) calls
during an standard Archlinux boot...
where is the "too early" boundary there? It's undefinable.
You either have entropy, or you don't. And if you don't, it will stay
like this forever, because if you had, you wouldn't have blocked in
the first place...
Thanks,
--
Ahmed Darwish
http://darwish.chasingpointers.com
