Messages in this thread | | | Date | Sat, 30 Jul 2011 18:25:49 -0400 | From | Ted Ts'o <> | Subject | Re: [PATCH 1/2] random: Add support for architectural random hooks |
| |
On Sat, Jul 30, 2011 at 09:29:18AM -1000, Linus Torvalds wrote: > The fact is, even if you worry about some back door for the NSA, or > some theoretical lack of perfect 32-bit randomness, we can pretty much > depend on it. We still do our own hashing on top of whatever entropy > we get out of rdrand, and we would still have all our other stuff. > Plus the instruction is public and testable - if Intel did something > wrong, they'll be *very* embarrassed.
Technically speaking, if Intel and the NSA were colluding together in a competent way, we'd never know; it's not something that could be tested. Intel could have implemented a incrementing counter which was initialized to some randomness, which was then encrypted by some NSA secret algorithm with a secret key known only to the NSA. We'd never know, but it would be enough of a backdoor for the NSA to do what they need to know. The only way it could leak out is via the human channel; if someone was upset enough about it that they send the algorithm and secret key to wikileaks.
But yeah, we can definitely depend on it if it is hashed into the pool and it's on top of everything else that we do. And it's all a matter of how paranoid you want to be. If you are working for government, where the NSA is by definition one of the good guys, then using rdrand directly is completely not a problem. If you are working for any other government agency, you'd probably want to mix it into the a random pool just to feel better about implicitly trusting Intel.
So I agree with Linus here.
- Ted
| |