[lkml]   [2002]   [Aug]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: Problem with random.c and PPC
    On Sat, Aug 17, 2002 at 03:09:50AM -0600, Andreas Dilger wrote:
    > >
    > > Not sure this is an ideal fix. We might instead have an entropy
    > > low-water mark (say 1/2 pool size), below which /dev/urandom will not
    > > deplete the pool. This way when we have ample entropy, both devices
    > > will behave like TRNGs, with /dev/urandom falling back to PRNG when a
    > > shortage is threatened.
    > Well, I can think of a few mechanisms that would work better than a
    > simple on/off method that you are proposing. The current code will
    > basically "fill" the urandom pool each time it is depleted, and then
    > when the entropy is gone it will just go on dumping out data. You
    > could make urandom only get more entropy each N times through its pool,
    > or make N a function of the "fullness" of the available entropy. Then
    > if a system has lots of entropy sources urandom is TRNG, but if not
    > it will gracefully degrade from TRNG to PRNG without wiping out all
    > the entropy in the process.
    > As an alternative, instead of taking poolsize bytes of entropy each
    > N uses, you could take some small amount of entropy to mix into the
    > pool slowly.

    Actually, that gives us exactly the scenario catastrophic reseeding
    intends to avoid. Presume for a moment that the internal state of the
    PRNG is somehow known to an attacker - the PRNG has been broken. If we
    take eight bits out of the entropy pool, mix them in, then generate a
    new random number, an attacker needs to only test 256 possible pool
    states before he knows the entire state again. If he keeps up this
    state extension attack, /dev/urandom will never return to an unknown
    state. If, on the other hand, /dev/urandom waits until there are, say,
    64 entropy bits to mix in, it can make a leap to a state that the
    attacker will have a very hard time guessing and the PRNG has

    We merely need to avoid starvation of /dev/random, and I think a
    straightforward low watermark approach will do that nicely. Starving
    /dev/urandom is no worse than feeding it a trickle.

    "Love the dolphins," she advised him. "Write by W.A.S.T.E.."
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    More majordomo info at
    Please read the FAQ at

     \ /
      Last update: 2005-03-22 13:28    [W:0.030 / U:10.444 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site