Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1656963

Re: [kernel-hardening] Re: get_random_bytes returns bad randomness before seeding is complete

Show all headers | View raw

On 3 June 2017 at 18:54, Jeffrey Walton <noloader@gmail.com> wrote:
> On Sat, Jun 3, 2017 at 5:45 PM, Sandy Harris <sandyinchina@gmail.com> wrote:
>> ...
>> Of course this will fail on systems with no high-res timer. Are there
>> still some of those? It might be done in about 1000 times as long on a
>> system that lacks the realtime library's nanosecond timer but has the
>> Posix standard microsecond timer, implying a delay time in the
>> milliseconds. Would that be acceptable in those cases?
>
> A significant portion of the use cases should include mobile devices.
> Device sales outnumbered desktop and server sales several years ago.
>
> Many devices are sensor rich. Even the low-end ones come with
> accelorometers for gaming. A typical one has 3 or 4 sensors, and
> higher-end ones have 7 or 8 sensors. An Evo 4G has 7 of them.
>
> There's no wanting for entropy in many of the use cases. The thing
> that is lacking seems to be taking advantage of it.
>
> Jeff

Hardware random number generator support is also standard on even
low-end mobile devices. The Linux kernel now knows to feed some of the
entropy from those hardware random generators into the kernel CSPRNG
when the driver is initialized but that doesn't happen until fairly
late in the kernel's boot process. The sensors present the same issue.
They aren't available when the kernel starts needing entropy for
features like SSP and KASLR or other early boot uses, unlike
RDRAND/RDSEED on modern x86_64 CPUs.

For userspace, Android's init system blocks until a certain amount of
entropy is obtained from one for the kernel CSPRNG. It's possible for
there to be no hwrandom but I think that's very rare now since the
standard SoCs used everywhere have it available. The device vendor
would probably need to go out of the way to break it. Android also
regularly saves a persistent random seed and restores it on boot. It
also mixes in entropy from the hardware generator regularly since the
kernel didn't know how to do that before, just like it didn't know how
to grab any initial entropy from the hardware generator.

I don't think it's worth worrying too much about mobile. Slimmer
embedded devices that probably don't even save / restore a seed in
many cases or generate keys on first boot before that helps are the
real issue. At least if you're not focused on KASLR and other early
probabilistic kernel exploit mitigations where there's a lack of a way
to get entropy in early boot right now unless the bootloader helps.

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

get_random_bytes returns bad randomness before seeding is complete "Jason A. Donenfeld" <Jason@zx2c4.com> - 2017-06-02 17:10 +0200
  Re: get_random_bytes returns bad randomness before seeding is complete "Jason A. Donenfeld" <Jason@zx2c4.com> - 2017-06-02 18:00 +0200
    Re: get_random_bytes returns bad randomness before seeding is complete "Jason A. Donenfeld" <Jason@zx2c4.com> - 2017-06-02 18:50 +0200
    Re: [kernel-hardening] Re: get_random_bytes returns bad randomness  before seeding is complete Daniel Micay <danielmicay@gmail.com> - 2017-06-02 19:50 +0200
      Re: [kernel-hardening] Re: get_random_bytes returns bad randomness  before seeding is complete "Jason A. Donenfeld" <Jason@zx2c4.com> - 2017-06-02 19:50 +0200
      Re: [kernel-hardening] Re: get_random_bytes returns bad randomness  before seeding is complete Kees Cook <keescook@chromium.org> - 2017-06-02 21:00 +0200
  Re: get_random_bytes returns bad randomness before seeding is  complete Theodore Ts'o <tytso@mit.edu> - 2017-06-02 19:30 +0200
    Re: get_random_bytes returns bad randomness before seeding is complete "Jason A. Donenfeld" <Jason@zx2c4.com> - 2017-06-02 19:50 +0200
      Re: get_random_bytes returns bad randomness before seeding is  complete Theodore Ts'o <tytso@mit.edu> - 2017-06-02 21:10 +0200
        Re: get_random_bytes returns bad randomness before seeding is complete "Jason A. Donenfeld" <Jason@zx2c4.com> - 2017-06-03 02:00 +0200
          Re: [kernel-hardening] Re: get_random_bytes returns bad randomness  before seeding is complete Sandy Harris <sandyinchina@gmail.com> - 2017-06-03 02:30 +0200
          [PATCH RFC 2/3] random: add get_random_{bytes,u32,u64,int,long}_wait family "Jason A. Donenfeld" <Jason@zx2c4.com> - 2017-06-03 04:40 +0200
          [PATCH RFC 0/3] get_random_bytes seed blocking "Jason A. Donenfeld" <Jason@zx2c4.com> - 2017-06-03 04:40 +0200
            [PATCH RFC 1/3] random: add synchronous API for the urandom pool "Jason A. Donenfeld" <Jason@zx2c4.com> - 2017-06-03 04:40 +0200
            [PATCH RFC 3/3] random: warn when kernel uses unseeded randomness "Jason A. Donenfeld" <Jason@zx2c4.com> - 2017-06-03 04:40 +0200
          Re: get_random_bytes returns bad randomness before seeding is  complete Theodore Ts'o <tytso@mit.edu> - 2017-06-03 07:10 +0200
            Re: get_random_bytes returns bad randomness before seeding is complete "Jason A. Donenfeld" <Jason@zx2c4.com> - 2017-06-03 14:40 +0200
              Re: get_random_bytes returns bad randomness before seeding is complete Sandy Harris <sandyinchina@gmail.com> - 2017-06-03 23:50 +0200
                Re: get_random_bytes returns bad randomness before seeding is complete Jeffrey Walton <noloader@gmail.com> - 2017-06-04 01:00 +0200
                Re: [kernel-hardening] Re: get_random_bytes returns bad randomness  before seeding is complete Daniel Micay <danielmicay@gmail.com> - 2017-06-04 02:00 +0200
                Re: get_random_bytes returns bad randomness before seeding is complete Stephan Müller <smueller@chronox.de> - 2017-06-04 08:00 +0200
  Re: get_random_bytes returns bad randomness before seeding is complete Stephan Müller <smueller@chronox.de> - 2017-06-04 07:50 +0200
    Re: get_random_bytes returns bad randomness before seeding is complete Jeffrey Walton <noloader@gmail.com> - 2017-06-04 08:00 +0200
  Re: get_random_bytes returns bad randomness before seeding is complete Stephan Müller <smueller@chronox.de> - 2017-06-04 08:30 +0200

csiph-web