lkml.org 
[lkml]   [2005]   [Mar]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    Date
    From
    SubjectRe: [PATCH] API for true Random Number Generators to add entropy (2.6.11)
    > We -used- to need data from RNG directly into the kernel randomness 

    Are you sure? I dont think there was ever code to do this in
    mainline. There might have been something in -ac*, but not mainline.

    > pool. The consensus was that the FIPS testing should be moved to userspace.

    Consensus from whom? And who says the FIPS testing is useful anyways?

    I think you just need to trust the random generator, it is like
    you need to trust any other piece of hardware in your machine. Or do you
    check regularly if you mov instruction still works? @)

    I think it is a trade off between easy to use and saving of
    resources and overly paranoia. With an user space solution
    which near nobody uses currently (I am not aware of
    any distribution that runs that daemon)
    it means most people wont have hardware supported randomness
    in their ssh, and I think that is a big drawback.

    Also I dont like the memory consumption of the daemon. It needs
    at least 20+k for kernel stack, page tables etc. I know
    a lot of people dont care about memory usage anymore, but I still
    do. It is not a lot of memory, but bloat does usually not come in big
    pieces but in small amounts of a time. And the code to do it
    from kernel space is really simple.

    And it would suddenly make a lot of peoples ssh/https etc. more secure,
    which is a good thing. Probably would help Linux security a lot
    more than all these crazy - "ABI, what ABI?" - buffer overflow
    workarounds.

    If you are really paranoid you can always turn off the sysctl
    and do it from userspace.

    -Andi
    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2005-04-06 13:31    [W:0.020 / U:31.104 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site