[lkml]   [2015]   [Apr]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: DRBG seeding
On Sat, Apr 18, 2015 at 04:04:14AM +0200, Stephan Mueller wrote:
> However, the only serious solution I can offer to not block is to use my
> Jitter RNG which delivers entropy in (almost all) use cases. See [1]. The code
> is relatively small and does not have any dependencies. In this case, we could
> perform the initialization of the DRBG as follows:
> 1. pull buffer of size entropy + nonce from get_random_bytes
> 2. pull another buffer of size entropy + nonce from my Jitter RNG
> 3. XOR both

Don't xor them. Just provide them both as input to the seed

> 4. seed the DRBG with it
> 5. trigger the async invocation of the in-kernel /dev/random
> 6. return the DRBG instance to the caller without waiting for the completion
> of step 5
> This way, we will get entropy during the first initialization without
> blocking. After speaking with mathematicians at NIST, that Jitter RNG approach
> would be accepted. Note, I personally think that the Jitter RNG has sufficient
> entropy in almost all circumstances (see the massive testing I conducted on
> all more widely used CPUs).
> [1]

OK this sounds like it should satisfy everybody.

Email: Herbert Xu <>
Home Page:
PGP Key:

 \ /
  Last update: 2015-04-18 05:01    [W:0.031 / U:0.044 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site