From: Javier Martinez Canillas <martinez.javier@xxxxxxxxx> Date: Tue, 29 Mar 2011 04:27:31 +0200 > The IRQF_SAMPLE_RANDOM flag is marked as deprecated and will be removed. > > Every input point to the kernel's entropy pool have to better document the > type of entropy source it is. > > drivers/char/random.c now implements a set of interfaces that can be used for > devices to collect enviromental noise. IRQF_SAMPLE_RANDOM will be replaced > with these add_*_randomness exported functions. > > Network drivers are not a good source of entropy. They use as a source of > entropy essentially a remote host. Which means that the source of entropy can > be potentially controlled by an attacker. Also, with heavy workloads the > entropy decreases due to less hardware interrupts happening thanks to irq > mitigation and NAPI. > > If a system relies in its network interface as a entropy source it has a false > sense of security. Systems that don't have devices whose drivers are good > sources of entropy, should either use a hardware random number generator or > feed the kernel's entropy pool from userspace using other sources of entropy > such as EGD, video_entropyd, timer_entropyd and audio-entropyd. > > Signed-off-by: Javier Martinez Canillas <martinez.javier@xxxxxxxxx> Appied to net-next-2.6, thanks! -- To unsubscribe from this list: send the line "unsubscribe kernel-janitors" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
