3 ms·
Chicken and egg; it won't properly boot until it has enough entropy, and you don't get enough entropy until it is booted. The proper fix is to change the boot
by tankenmate 9y ago
Chicken and egg; it won't properly boot until it has enough entropy, and you don't get enough entropy until it is booted.
The proper fix is to change the boot scripts to not assume that the CRNG will be available directly after boot.
- jakeogh 9y agoIt's better to deadlock than to revert to a weak RNG. Deadlocking guarantees the application gets fixed. Reminds me of setting an init system to restart crashed daemons.
- zaarn 9y agoThe kernel doesn't do that. Above all else, the rule is that the kernel shouldn't cause userspace regressions. Something that works now must continue working later.
- amelius 9y agoOr how about it blocks, and then if the user starts rambling on the keyboard, it collects entropy?
- jakeogh 9y agoRight, that would be fine. I think. The point is it's gotta break in a way that requires attention. In the IOT setting often no user input easily available. The OS should not lie to the apps when it hands them numbers that are supposed to be crypto random.
- sangnoir 9y ago> It's better to deadlock than to revert to a weak RNG ..for you. Other people have a different threat model where availability is ranked above RNG strength in the first minute of booting. Making security decisions not based on any sort of threat model considerations is zealotry/cargo-culting, IMO.
- deleted 9y ago[deleted]