3 ms·
Linux RNGs: where refusing to XOR in additional hardware randomness into the output stream is not just a defensible opinion, but the dominant one.
by ianmiers 11y ago
Linux RNGs: where refusing to XOR in additional hardware randomness into the output stream is not just a defensible opinion, but the dominant one.
- Natanael_L 11y agoRefusing to XOR it in is sensible. That RNG hardware might know too much about your existing entropy pool (either malicious bias or design flaws). Rejecting to mix it in cryptographically is however dumb.
- ryuuchin 11y agoExcept they do use rdrand if supported. When the random function is called it does a SHA transform. The SHA state gets initialized with rdrand and then the kernel pool is mixed in. This avoids the theoretical issues with xoring rdrand directly into the output. You should generally avoid xor when it comes to untrusted output such as rdrand since it could theoretically control what gets generated and as such could cancel out whatever you're xoring it with (or at least this is the claim AFAIK). It's better to mix it using some other method, e.g. hash or cipher[1]. [1] https://boringssl.googlesource.com/boringssl/+/master/crypto/rand/rand.c#29 https://boringssl.googlesource.com/boringssl/+/master/crypto...
- deleted 11y ago[deleted]