On Tue, Sep 17, 2019 at 05:34:56PM +0100, Matthew Garrett wrote: > On Tue, Sep 17, 2019 at 09:27:44AM -0700, Linus Torvalds wrote: > > > Does anybody believe that 128 bits of randomness is a good basis for a > > long-term secure key? > > Yes, it's exactly what you'd expect for an AES 128 key, which is still > considered to be secure. AES keys are for symmetrical encryption and thus as such are short-lived. We're back to what Linus was saying about the fact that our urandom is already very good for such use cases, it should just not be used to produce long-lived keys (i.e. asymmetrical). However I'm worried regarding this precise patch about the fact that delays will add up. I think that once we've failed to wait for a first process, we've broken any hypothetical trust in terms of random quality so there's no point continuing to wait for future requests. Willy
