lkml.org 
[lkml]   [2022]   [Feb]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH v2 2/4] random: simplify entropy debiting
Am Fri, Feb 04, 2022 at 02:53:23PM +0100 schrieb Jason A. Donenfeld:
> Our pool is 256 bits, and we only ever use all of it or don't use it at
> all, which is decided by whether or not it has 128 bits in it. So we can

"has at least"

> drastically simplify the accounting and cmpxchg loop to do exactly this.
> While we're at it, we move the minimum bit size into a constant so it
> can be shared between the two places where it matters.
>
> The reason we want any of this is for the case in which an attacker has
> compromised the current state, and then bruteforces small amounts of
> entropy added to it. By demanding a particular minimum amount of entropy
> be present before reseeding, we make that bruteforcing difficult.
>
> Note that this rationale no longer includes anything about /dev/random
> blocking at the right moment, since /dev/random no longer blocks (except
> for at ~boot), but rather uses the crng. In a former life, /dev/random
> was different and therefore required a more nuanced account(), but this
> is no longer.
>
> Behaviorally, nothing changes here. This is just a simplification of
> the code.
>
> Cc: Theodore Ts'o <tytso@mit.edu>
> Cc: Dominik Brodowski <linux@dominikbrodowski.net>
> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>

Reviewed-by: Dominik Brodowski <linux@dominikbrodowski.net>

Thanks,
Dominik

\
 
 \ /
  Last update: 2022-02-05 09:25    [W:0.073 / U:4.056 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site