3 ms·

Looking at the patch, they just modified rngd to populate /dev/random from /dev/urandom instead of /dev/hwrng. /dev/urandom in turn just uses the kernel's inte

by B-Con 14y ago

Looking at the patch, they just modified rngd to populate /dev/random from /dev/urandom instead of /dev/hwrng. /dev/urandom in turn just uses the kernel's internal entropy pool, which is the same one /dev/random uses, and a PRNG to stretch the entropy when the raw entropy available is depleted. My fear here is that the kernel's internal entropy pool is just constantly being replaced by the PRNG output from /dev/urandom, which is then being used by /dev/urandom to reseed it's PRNG output, causing essentially just a cascade of a PRNG reseeding itself. In turn, /dev/urandom's PRNG was seeded by some initial entropy condition that may have been less than optimal, especially if it was just whatever default was there soon after boot time. If /dev/hwrng was designed to be a primary, or worse the, source of good entropy, then this patch may have eliminated good entropy. Anyone with kernel-level knowledge of the Linux entropy pool care to weigh in? I don't know as much as I wish I did.

nly2 14y ago
random and urandom are more or less the same... /dev/random is still a PRNG, using the same algorithms as urandom, it just maintains a record of some desirable degree of estimated entropy and just blocks until it's satisfied. They also use separate entropy buffers, called the blocking and non-blocking pools, respectively. The latter doesn't directly seed itself from the former like you might expect. Both use the SHA1 hash function on their buffers, presumably to prevent any practical leakage of raw data from the pool to the outside world, and both then mix this hash back in to their pool before outputting just half of it to the user.
mook 14y ago
According to https://lwn.net/Articles/525459/ https://lwn.net/Articles/525459/ filling the entropy pool with /dev/urandom is a bad idea. Of course, checking my Nexus S, /dev/hwrng just plain doesn't exist; I assume that means the kernel would normally get entropy from other sources at a slower rate.

by B-Con 14y ago

nly2 14y ago

random and urandom are more or less the same... /dev/random is still a PRNG, using the same algorithms as urandom, it just maintains a record of some desirable degree of estimated entropy and just blocks until it's satisfied. They also use separate entropy buffers, called the blocking and non-blocking pools, respectively. The latter doesn't directly seed itself from the former like you might expect. Both use the SHA1 hash function on their buffers, presumably to prevent any practical leakage of raw data from the pool to the outside world, and both then mix this hash back in to their pool before outputting just half of it to the user.

mook 14y ago

According to https://lwn.net/Articles/525459/ https://lwn.net/Articles/525459/ filling the entropy pool with /dev/urandom is a bad idea. Of course, checking my Nexus S, /dev/hwrng just plain doesn't exist; I assume that means the kernel would normally get entropy from other sources at a slower rate.