Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1656647

Re: [kernel-hardening] Re: get_random_bytes returns bad randomness before seeding is complete

From Sandy Harris <sandyinchina@gmail.com>
Newsgroups linux.kernel
Subject Re: [kernel-hardening] Re: get_random_bytes returns bad randomness before seeding is complete
Date 2017-06-03 02:30 +0200
Message-ID <tO574-8f3-9@gated-at.bofh.it> (permalink)
References <tNWn9-2Pu-57@gated-at.bofh.it> <tNYyB-49F-1@gated-at.bofh.it> <tNYRY-4gc-9@gated-at.bofh.it> <tO07o-5bS-13@gated-at.bofh.it> <tO4E2-7Qc-13@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw

The only sensible & general solution for the initialisation problem
that I have seen is John Denker's.
http://www.av8n.com/computer/htm/secure-random.htm#sec-boot-image

If I read that right, it would require only minor kernel changes &
none to the API Ted & others are worrying about. It would be secure
except against an enemy who can read your kernel image or interfere
with your install process. Assuming permissions are set sensibly, that
means an enemy who already has root & such an enemy has lots of much
easier ways to break things, so we need not worry about that case.

The difficulty is that it would require significant changes to
installation scripts. Still, since it is a general solution to a real
problem, it might be better to implement that rather than work on the
other suggestions in the thread.

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

get_random_bytes returns bad randomness before seeding is complete "Jason A. Donenfeld" <Jason@zx2c4.com> - 2017-06-02 17:10 +0200
  Re: get_random_bytes returns bad randomness before seeding is complete "Jason A. Donenfeld" <Jason@zx2c4.com> - 2017-06-02 18:00 +0200
    Re: get_random_bytes returns bad randomness before seeding is complete "Jason A. Donenfeld" <Jason@zx2c4.com> - 2017-06-02 18:50 +0200
    Re: [kernel-hardening] Re: get_random_bytes returns bad randomness  before seeding is complete Daniel Micay <danielmicay@gmail.com> - 2017-06-02 19:50 +0200
      Re: [kernel-hardening] Re: get_random_bytes returns bad randomness  before seeding is complete "Jason A. Donenfeld" <Jason@zx2c4.com> - 2017-06-02 19:50 +0200
      Re: [kernel-hardening] Re: get_random_bytes returns bad randomness  before seeding is complete Kees Cook <keescook@chromium.org> - 2017-06-02 21:00 +0200
  Re: get_random_bytes returns bad randomness before seeding is  complete Theodore Ts'o <tytso@mit.edu> - 2017-06-02 19:30 +0200
    Re: get_random_bytes returns bad randomness before seeding is complete "Jason A. Donenfeld" <Jason@zx2c4.com> - 2017-06-02 19:50 +0200
      Re: get_random_bytes returns bad randomness before seeding is  complete Theodore Ts'o <tytso@mit.edu> - 2017-06-02 21:10 +0200
        Re: get_random_bytes returns bad randomness before seeding is complete "Jason A. Donenfeld" <Jason@zx2c4.com> - 2017-06-03 02:00 +0200
          Re: [kernel-hardening] Re: get_random_bytes returns bad randomness  before seeding is complete Sandy Harris <sandyinchina@gmail.com> - 2017-06-03 02:30 +0200
          [PATCH RFC 2/3] random: add get_random_{bytes,u32,u64,int,long}_wait family "Jason A. Donenfeld" <Jason@zx2c4.com> - 2017-06-03 04:40 +0200
          [PATCH RFC 0/3] get_random_bytes seed blocking "Jason A. Donenfeld" <Jason@zx2c4.com> - 2017-06-03 04:40 +0200
            [PATCH RFC 1/3] random: add synchronous API for the urandom pool "Jason A. Donenfeld" <Jason@zx2c4.com> - 2017-06-03 04:40 +0200
            [PATCH RFC 3/3] random: warn when kernel uses unseeded randomness "Jason A. Donenfeld" <Jason@zx2c4.com> - 2017-06-03 04:40 +0200
          Re: get_random_bytes returns bad randomness before seeding is  complete Theodore Ts'o <tytso@mit.edu> - 2017-06-03 07:10 +0200
            Re: get_random_bytes returns bad randomness before seeding is complete "Jason A. Donenfeld" <Jason@zx2c4.com> - 2017-06-03 14:40 +0200
              Re: get_random_bytes returns bad randomness before seeding is complete Sandy Harris <sandyinchina@gmail.com> - 2017-06-03 23:50 +0200
                Re: get_random_bytes returns bad randomness before seeding is complete Jeffrey Walton <noloader@gmail.com> - 2017-06-04 01:00 +0200
                Re: [kernel-hardening] Re: get_random_bytes returns bad randomness  before seeding is complete Daniel Micay <danielmicay@gmail.com> - 2017-06-04 02:00 +0200
                Re: get_random_bytes returns bad randomness before seeding is complete Stephan Müller <smueller@chronox.de> - 2017-06-04 08:00 +0200
  Re: get_random_bytes returns bad randomness before seeding is complete Stephan Müller <smueller@chronox.de> - 2017-06-04 07:50 +0200
    Re: get_random_bytes returns bad randomness before seeding is complete Jeffrey Walton <noloader@gmail.com> - 2017-06-04 08:00 +0200
  Re: get_random_bytes returns bad randomness before seeding is complete Stephan Müller <smueller@chronox.de> - 2017-06-04 08:30 +0200

csiph-web