5 ms·
What kind of applications need cryptographic randomness during early boot?
by edflsafoiewq 9y ago
What kind of applications need cryptographic randomness during early boot?
- tinus_hn 9y agoThe classic application is generating the ssh server keys. I don’t know if that solely uses the system RNG though.
- AstralStorm 9y agoPretty silly. If you can network, you have access to at least 3 decent sources of entropy. (Network traffic, hardware clock randomness and network device clock. Potentially power supply monitoring and bus clocks. And finally thermal sources.) And then you can always bake in the key into flash. The problem here is that you would have to probe RNG stats manually as it returned readiness too early.
- tinus_hn 9y agoYou don’t need network to start the SSH server, it just listens on all interfaces. Also, although it doesn’t matter that much in this case, trusting the network for entropy is not such a great idea because it isn’t trusted.
- AstralStorm 9y agoThat is only relevant if your entropy estimator and mixer is broken and/or you have too few entropy sources. Linux entropy handling is quite well tested. (As opposed to initialization of the RNG.)
- IcePic 9y agoI wonder what sshd could turn to in order to get entropy if the system doesn't think it has enough?
- tinus_hn 9y agoIf it can tell if the system doesn’t have enough, it can just wait for a while longer.