4 ms·
Just to be sure I understand fully, if I take a small embedded router running OpenWRT, that maybe take ~1min for the urandom pool to be ready. https://git.openw
by champtar 8y ago
Just to be sure I understand fully, if I take a small embedded router running OpenWRT, that maybe take ~1min for the urandom pool to be ready.
https://git.openwrt.org/?p=openwrt/openwrt.git;a=commitdiff;h=3946a5529132c80793a9e5ee665a3cd6b0835310;hp=e408abd7fb8e2a8842726345f393236c53496933 https://git.openwrt.org/?p=openwrt/openwrt.git;a=commitdiff;...
On the first boot we save 512 bytes from getrandom().
On the second boot we restore the seed (cat seed > /dev/urandom) before almost all the user space starts.
Many daemons (dropbear/openvpn) will read from /dev/urandom before urandom pool is considered ready, but after the seed is restored.
With the new patches, are the daemons benefiting from the seed ?
- mkj 8y agoNote that Dropbear will read urandom upon each incoming connection so that should be mitigated in many circumstances. (Hopefully some systems are using the delayed hostkey generation option too)