Re: Fixing Linux getrandom() in stable

Path	csiph.com!aioe.org!bofh.it!news.nic.it!robomod
From	Ben Hutchings <ben@decadent.org.uk>
Newsgroups	linux.debian.devel.release, linux.debian.kernel
Subject	Re: Fixing Linux getrandom() in stable
Date	Sun, 13 May 2018 19:20:02 +0200
Message-ID	<vP2P8-5CU-11@gated-at.bofh.it> (permalink)
References	<vNG4i-TU-1@gated-at.bofh.it> <vOVui-1cj-7@gated-at.bofh.it>
X-Original-To	Yves-Alexis Perez <corsac@debian.org>, Debian release team <debian-release@lists.debian.org>
X-Mailbox-Line	From debian-release-request@lists.debian.org Sun May 13 17:13:42 2018
Old-Return-Path	<ben@decadent.org.uk>
X-Amavis-Spam-Status	No, score=-12.063 tagged_above=-10000 required=5.3 tests=[BAYES_00=-2, LDO_WHITELIST=-5, PGPSIGNATURE=-5, RCVD_IN_DNSWL_LOW=-0.7, SARE_MSGID_LONG40=0.637] autolearn=ham autolearn_force=no
X-Policyd-Weight	DYN_NJABL=SKIP(0) NOT_IN_SBL_XBL_SPAMHAUS=-1.5 NOT_IN_BL_NJABL=-1.5 CL_IP_EQ_FROM_MX=-3.1; rate: -6.1
Content-Type	multipart/signed; micalg="pgp-sha512"; protocol="application/pgp-signature"; boundary="=-CFBetE1AmH/9JQ5+COGI"
X-Mailer	Evolution 3.28.1-2
MIME-Version	1.0
X-Sa-Exim-Connect-IP	2a02:8011:400e:2:6f00:88c8:c921:d332
X-Sa-Exim-Mail-From	ben@decadent.org.uk
X-Sa-Exim-Scanned	No (on shadbolt.decadent.org.uk); SAEximRunCond expanded to false
X-Mailing-List	<debian-release@lists.debian.org> archive/latest/114465
List-ID	<debian-release.lists.debian.org>
List-URL	<https://lists.debian.org/debian-release/>
List-Archive	https://lists.debian.org/msgid-search/4ab0cdba0b62face283cac765a03f0b2b468ccd9.camel@decadent.org.uk
Approved	robomod@news.nic.it
Lines	59
Organization	linux.* mail to news gateway
Sender	robomod@news.nic.it
X-Original-Cc	Debian kernel maintainers <debian-kernel@lists.debian.org>, krb5@packages.debian.org, libbsd@packages.debian.org, systemd@packages.debian.org
X-Original-Date	Sun, 13 May 2018 18:13:15 +0100
X-Original-Message-ID	<4ab0cdba0b62face283cac765a03f0b2b468ccd9.camel@decadent.org.uk>
X-Original-References	<75577b3d2efd01aaf563f1a1400a2c655556b258.camel@decadent.org.uk> <e9d9c00ab79f19cd1a0120ca11dd9302d742bc52.camel@debian.org>
Xref	csiph.com linux.debian.devel.release:79911 linux.debian.kernel:60990

Cross-posted to 2 groups.

Show key headers only | View raw

[Multipart message — attachments visible in raw view] - view raw

On Sun, 2018-05-13 at 11:27 +0200, Yves-Alexis Perez wrote:
> On Wed, 2018-05-09 at 23:46 +0100, Ben Hutchings wrote:
> > It is unlikely that any further fix will be forthcoming on the kernel
> > side, so I believe that we need to do one of:
> > 
> > 1. Add entropy to the kernel during boot; either:
> >    a. Improve systemd-random-seed
> >    b. Recommend use of haveged
> 
> There's also something which might be worth trying in coordination with
> upstream: credit entropy for platform RNG like RDRAND/RDSEED. It obviously
> won't fix the problem everywhere, but at least on “recent” Intel platforms
> there should be an entropy source available without any further initialization
> (unlike the TPM for example).
> 
> I know about the trust issues wrt. Intel, but maybe that should be revisited?

I think it would make sense to at least provide a run-time option for
trusting the platform RNG.

Ben.

-- 
Ben Hutchings
The most exhausting thing in life is being insincere.
                                                 - Anne Morrow Lindberg

Thread

Fixing Linux getrandom() in stable Ben Hutchings <ben@decadent.org.uk> - 2018-05-10 00:50 +0200
  Re: Fixing Linux getrandom() in stable Michael Biebl <biebl@debian.org> - 2018-05-10 15:50 +0200
    Re: Fixing Linux getrandom() in stable Russ Allbery <rra@debian.org> - 2018-05-10 19:30 +0200
      Re: Fixing Linux getrandom() in stable Michael Biebl <biebl@debian.org> - 2018-05-10 19:40 +0200
        Re: Fixing Linux getrandom() in stable Russ Allbery <rra@debian.org> - 2018-05-10 19:50 +0200
          Re: Fixing Linux getrandom() in stable Ian Campbell <ijc@debian.org> - 2018-05-10 21:20 +0200
        Re: Fixing Linux getrandom() in stable Benjamin Kaduk <kaduk@mit.edu> - 2018-05-10 19:50 +0200
  Re: Fixing Linux getrandom() in stable Yves-Alexis Perez <corsac@debian.org> - 2018-05-13 11:30 +0200
    Re: Fixing Linux getrandom() in stable Ben Hutchings <ben@decadent.org.uk> - 2018-05-13 19:20 +0200
  Re: Fixing Linux getrandom() in stable Adrian Bunk <bunk@debian.org> - 2018-05-13 22:50 +0200
    Re: Fixing Linux getrandom() in stable Thorsten Glaser <tg@mirbsd.de> - 2018-05-13 23:40 +0200
      Re: Fixing Linux getrandom() in stable Thorsten Glaser <tg@mirbsd.de> - 2018-05-14 03:00 +0200
      Re: Fixing Linux getrandom() in stable "Theodore Y. Ts'o" <tytso@mit.edu> - 2018-05-14 03:20 +0200
      Re: Fixing Linux getrandom() in stable Sam Hartman <hartmans@debian.org> - 2018-05-14 15:20 +0200
    Re: Fixing Linux getrandom() in stable Ben Hutchings <ben@decadent.org.uk> - 2018-05-14 04:20 +0200
      Re: Fixing Linux getrandom() in stable Adrian Bunk <bunk@debian.org> - 2018-05-22 21:50 +0200

csiph-web