5 ms·
If you have a fresh VM without a seed file, that isn't connected to the internet and has had little in the way of devices, and you immediately begin generating
by matt_wulfeck 10y ago
If you have a fresh VM without a seed file, that isn't connected to the internet and has had little in the way of devices, and you immediately begin generating keys before the normal file system operations stir the generator, then the deterministic nature of the generator says you'll get a predictable key, or more likely, end up generating a key that's simply not unique.
Just by being online and running for a few seconds will cause enough entropy to put the generator into a safe state, so this rarely happens in practice.
In fact Ubuntu comes prepackaged with pollinate[0] which makes this basically a non-issue for everyone that's not wearing a tinfoil hat.
1. http://manpages.ubuntu.com/manpages/trusty/man1/pollinate.1.html http://manpages.ubuntu.com/manpages/trusty/man1/pollinate.1....
- vram22 10y agoInteresting. I get part of it. How does being online increase entropy?
- matt_wulfeck 10y agoDevice interrupts will feed the generator so that the output from the CSPRNG is indistinguishable from random. There's lots of stuff happening on a network that's impossible to guess and replay. This is also called noise. Keep in mind that the CSPRNG generator only needs a random seed, then it can produce psuedo random numbers all day long. Linux will continue to reseed as more interrupts occur. Linux will also save a 512 byte file on shutdown and seed the generator with it on the next boot up, so you immediately enter into a safe/random state.
- vram22 10y agoThanks for all the answers.
- matt_wulfeck 10y agoI can't repond directly to you. Device interrupts will feed the generator so that the output from the CSPRNG is indistinguishable from random. There's lots of stuff happening on a network that's impossible to guess and replay.