Messages in this thread | ![/](/images/icornerl.gif) | | Date | Sat, 5 Feb 2022 08:18:30 +0100 | From | Dominik Brodowski <> | Subject | Re: [PATCH v2 2/4] random: simplify entropy debiting |
| |
Am Fri, Feb 04, 2022 at 02:53:23PM +0100 schrieb Jason A. Donenfeld: > Our pool is 256 bits, and we only ever use all of it or don't use it at > all, which is decided by whether or not it has 128 bits in it. So we can
"has at least"
> drastically simplify the accounting and cmpxchg loop to do exactly this. > While we're at it, we move the minimum bit size into a constant so it > can be shared between the two places where it matters. > > The reason we want any of this is for the case in which an attacker has > compromised the current state, and then bruteforces small amounts of > entropy added to it. By demanding a particular minimum amount of entropy > be present before reseeding, we make that bruteforcing difficult. > > Note that this rationale no longer includes anything about /dev/random > blocking at the right moment, since /dev/random no longer blocks (except > for at ~boot), but rather uses the crng. In a former life, /dev/random > was different and therefore required a more nuanced account(), but this > is no longer. > > Behaviorally, nothing changes here. This is just a simplification of > the code. > > Cc: Theodore Ts'o <tytso@mit.edu> > Cc: Dominik Brodowski <linux@dominikbrodowski.net> > Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> > Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Reviewed-by: Dominik Brodowski <linux@dominikbrodowski.net>
Thanks, Dominik
| ![\](/images/icornerr.gif) |