Re: [SECURITY] [DSA 4187-1] linux security update

From	Henrique de Moraes Holschuh <hmh@debian.org>
Newsgroups	linux.debian.security
Subject	Re: [SECURITY] [DSA 4187-1] linux security update
Date	2018-05-05 16:00 +0200
Message-ID	<vM5Tc-62v-17@gated-at.bofh.it> (permalink)
References	(1 earlier) <vL92N-d1-1@gated-at.bofh.it> <vLaBz-1fM-1@gated-at.bofh.it> <vLipr-74q-3@gated-at.bofh.it> <vLykx-19d-1@gated-at.bofh.it> <vLOyZ-3tC-3@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On Fri, 04 May 2018, Davide Prina wrote:
> On 04/05/2018 04:06, Paul Wise wrote:
> > On Thu, May 3, 2018 at 4:53 PM, richard lucassen wrote:
> > 
> > > There is also an big increase in time before random is initialized:
> > ...
> > > One of the consequences is that openntpd (or a program like
> > > rdate) hangs until the crng is initialized.
> > 
> > What do these two programs require entropy for?
> 
> security:
> 
> Integrates the latest secure API advances from OpenBSD such as
> getentropy(2), arc4random(3) (a fail-safe CSRNG that works in chroot
> environments), and reallocarray(3) (an integer overflow-checking
> malloc/calloc/realloc replacement).[1]
> 
> you can read more detail on NTP RFC[2]

Well, it is false security if it depends on a RNG with too little
entropy, and unless you have hardware assistance, that also means you
need to delay their start until the RNG is properly seeded.

Maybe we should have a systemd target/sysvinit facility that can be used
properly for "crng available" (and use the !@#$ one for clock sync'd as
well, related to ntp...  dnssec *really* depends on never enabling its
secure mode before you sync'd the clock, for example.  But lots of other
stuff would like to start providing service only after the local clock
has been made realtively accurate by ntp/sntp/whatever).

-- 
  Henrique Holschuh

Back to linux.debian.security | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

Re: [SECURITY] [DSA 4187-1] linux security update Dominic Hargreaves <dom@earth.li> - 2018-05-03 01:10 +0200
  Re: [SECURITY] [DSA 4187-1] linux security update Ben Hutchings <benh@debian.org> - 2018-05-03 02:50 +0200
    Re: [SECURITY] [DSA 4187-1] linux security update richard lucassen <mailinglists@lucassen.org> - 2018-05-03 11:10 +0200
      Re: [SECURITY] [DSA 4187-1] linux security update Konstantin Khomoutov <kostix@bswap.ru> - 2018-05-03 12:00 +0200
      Re: [SECURITY] [DSA 4187-1] linux security update Paul Wise <pabs@debian.org> - 2018-05-04 04:10 +0200
        Re: [SECURITY] [DSA 4187-1] linux security update Richard Lucassen <spamtrap@xaq.nl> - 2018-05-04 10:20 +0200
        Re: [SECURITY] [DSA 4187-1] linux security update Davide Prina <davide.prina@gmail.com> - 2018-05-04 21:30 +0200
          Re: [SECURITY] [DSA 4187-1] linux security update Henrique de Moraes Holschuh <hmh@debian.org> - 2018-05-05 16:00 +0200

csiph-web