lkml.org 
[lkml]   [2011]   [Jun]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
SubjectRe: random(4) driver questions
From
On Mon, Jun 27, 2011 at 10:54 PM, Ted Ts'o <tytso@mit.edu> wrote:

> Suffice it to say the random generator has changed significantly since
> 2006.  There is now a secondary pool, which uses catastrophic
> reseeding, etc.

Why does the secondary pool use another hash, rather than a
block cipher? I can see using a hash for the primary pool; at
the original design time, export laws were a concern, and in
any case a hash is the obvious mixing primitive there.

However, for the secondary pools, a block cipher seems to
me to be the obvious thing to use because there is plenty
of analysis, in the Yarrow paper and follow-ups, of that
technique. Also, I think it might be faster.

An AES-128 context, 11 128-bit round keys, is roughly the
same size as one of the current secondary pools, 32 32-bit
chunks. What would maintainers think of a patch along
those lines?

Another question is whether and when we might replace
SHA-1 with a more modern hash. Jeff Garzik has a patch
to add Skein to the crypto API. That would be faster
than SHA-1 and perhaps more easily analyzed since
the compression function is a block cipher. Of course
the SHA-3 Advanced Hash Standard process is not
scheduled to finish for another year and there's a
good argument that we should wait for that.

Also, though there are some attacks on SHA-1, none
of them appear to matter for this application, so
perhaps :If it ain't broke, don't fix it".
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2011-06-28 08:09    [W:0.076 / U:0.108 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site