Hi Ted, On 11/13/2016 11:20 PM, Theodore Ts'o wrote: > On Sat, Nov 12, 2016 at 01:25:11PM +0100, Michael Kerrisk (man-pages) wrote: >> ┌──────────────┬──────────────┬──────────────────┬────────────────────┐ >> │Interface │ Pool │ Blocking │ Behavior in early │ >> │ │ │ behavior │ boot time │ >> ├──────────────┼──────────────┼──────────────────┼────────────────────┤ >> │/dev/random │ Blocking │ If entropy too │ Blocks until │ >> │ │ pool │ low, block until │ enough entropy │ >> │ │ │ there is enough │ gathered │ >> │ │ │ entropy again │ │ >> ├──────────────┼──────────────┼──────────────────┼────────────────────┤ >> │/dev/urandom │ CSPRNG out‐ │ Never blocks │ Returns output │ >> │ │ put │ │ from uninitialized │ >> │ │ │ │ CSPRNG (may be low │ >> │ │ │ │ entropy and │ >> │ │ │ │ unsuitable for │ >> │ │ │ │ cryptography) │ >> ├──────────────┼──────────────┼──────────────────┼────────────────────┤ >> │getrandom() │ Same as │ Does not block │ Blocks until pool │ >> │ │ /dev/urandom │ once pool ready │ ready │ >> ├──────────────┼──────────────┼──────────────────┼────────────────────┤ >> │getrandom() │ Same as │ If entropy too │ Blocks until pool │ >> │GRND_RANDOM │ /dev/random │ low, block until │ ready │ >> │ │ │ there is enough │ │ >> │ │ │ entropy again │ │ >> ├──────────────┼──────────────┼──────────────────┼────────────────────┤ >> │getrandom() │ Same as │ Does not block │ EAGAIN if pool not │ >> │GRND_NONBLOCK │ /dev/urandom │ │ ready │ >> ├──────────────┼──────────────┼──────────────────┼────────────────────┤ >> │getrandom() │ Same as │ EAGAIN if not │ EAGAIN if pool not │ >> │GRND_RANDOM + │ /dev/random │ enough entropy │ ready │ >> │GRND_NONBLOCK │ │ available │ │ >> └──────────────┴──────────────┴──────────────────┴────────────────────┘ > > I would change the rightmost column to be "Behavior when pool not yet > ready", and just the text in that column accordingly. Yes, better. Changed. > And the cell, getrandom() GRND_NONBLOCK and blocking behavior, "does > not block" is not quite right. It's EAGAIN if pool not ready. > > This distinguishes this from /dev/urandom & blocking behavior's "Never > blocks", in that it will return potentially not fully secure > randomness if the pool is not initialized. I see what you mean, but I think Laurent meant that point to be covered in the rightmost column. So, to try to make this clearer, I changed the text in that cell to "Does not block once the pool is read". If this still seems problematic, let me know for the next version of the page. (I'll send out a new draft in a moment.) Cheers, Michael -- Michael Kerrisk Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/ Linux/UNIX System Programming Training: http://man7.org/training/ -- To unsubscribe from this list: send the line "unsubscribe linux-man" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
