From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.saout.de ([127.0.0.1]) by localhost (mail.saout.de [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RA5ohWVBS1ie for ; Fri, 24 Aug 2012 17:14:40 +0200 (CEST) Received: from v4.tansi.org (ns.km33513-03.keymachine.de [87.118.94.3]) by mail.saout.de (Postfix) with ESMTP for ; Fri, 24 Aug 2012 17:14:40 +0200 (CEST) Received: from gatewagner.dyndns.org (84-72-142-78.dclient.hispeed.ch [84.72.142.78]) by v4.tansi.org (Postfix) with ESMTPA id 038AA206697 for ; Fri, 24 Aug 2012 17:14:40 +0200 (CEST) Date: Fri, 24 Aug 2012 17:14:39 +0200 From: Arno Wagner Message-ID: <20120824151439.GA30694@tansi.org> References: <20120823090049.GB14639@Latty> <20120823112728.GA20834@tansi.org> <20120823151025.GM14639@Latty> <20120823160728.GA26979@tansi.org> <5036729B.1060905@gmail.com> <20120823193415.GA31534@tansi.org> <50378927.7090508@gmail.com> <20120824144028.GB2407@fancy-poultry.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20120824144028.GB2407@fancy-poultry.org> Subject: Re: [dm-crypt] Encrypt all partitions with dm-crypt List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: dm-crypt@saout.de On Fri, Aug 24, 2012 at 04:40:28PM +0200, Heinz Diehl wrote: > On 24.08.2012, Milan Broz wrote: > > > There is currently a lot of effort to ensure that /dev/urandom > > cannot produce weak data even in extreme situations. > > I'm more than happy that Intels hardware RNG isn't used as the only > source for randomness on systems where it is available (as proposed by > Linus himself). > > https://patchwork.kernel.org/patch/1161881/ I agree. I think Linux does not quite understand the issue here. If some Intel chips are compromised, nothing but a very expensive hardware analysis or a massive intelligence blunder would reveal that, hence it is very, very unlikely for Intel (or any other CPU maker) to get caught red-handed. On the other hand, mixing in a reasonable amount of other randomness negates any attack possibilities via the HW RNG and at the same time allows it to be used as high-quality "stretching" material. For example, using 512 bits of other entropy and stretch this to a few MB with the HW RNG would still be fine (if done right) even if the HW RNG is compromised. The solurtion by Tso makes perfect sense cryptographically and from a risk-management perspective. Never put all your eggs in one basket unless there really is no other choice. Arno -- Arno Wagner, Dr. sc. techn., Dipl. Inform., Email: arno@wagner.name GnuPG: ID: 1E25338F FP: 0C30 5782 9D93 F785 E79C 0296 797F 6B50 1E25 338F ---- One of the painful things about our time is that those who feel certainty are stupid, and those with any imagination and understanding are filled with doubt and indecision. -- Bertrand Russell