5 ms·

I thought of this issue over a year ago. See: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=c2557a303ab6712bb6e09447df828c557c710ac

• btilly 13y ago
  One question based on discussion up thread. With the current code, if the hardware was truly untrustworthy, it could do a brief analysis of upcoming CPU instructions, and if it sees that it is XORed with something, it could quickly XOR itself with that something in advance so that it can completely control the output of the function. For sheer paranoia, wouldn't it make sense to mix the hardware entropy into the pool earlier in the function so that it malicious hardware would have to work harder to control the output? It could, of course, still take over. But logic to do so would have to be more intrusive than the XOR hack that I suggested, and so would be more likely to get caught.
  • tytso 13y ago
    I'm not convinced the XOR hack could be done in a way such that it wouldn't be noticed by someone inside Intel. But sure, we could do that. It would require calling RDRAND a new more times, but it's relatively cheap.
    • btilly 13y ago
      The concern is not that Intel wouldn't notice it. The concern is that Intel is complicit in the attack.