From: "Stephan Müller" <smueller@chronox.de>
To: Andy Lutomirski <luto@kernel.org>
Cc: Ted Ts'o <tytso@mit.edu>, LKML <linux-kernel@vger.kernel.org>,
Linux API <linux-api@vger.kernel.org>,
Kees Cook <keescook@chromium.org>,
"Jason A. Donenfeld" <Jason@zx2c4.com>,
"Ahmed S. Darwish" <darwish.07@gmail.com>,
Lennart Poettering <mzxreary@0pointer.de>,
"Eric W. Biederman" <ebiederm@xmission.com>,
"Alexander E. Patrakov" <patrakov@gmail.com>,
Michael Kerrisk <mtk.manpages@gmail.com>,
Willy Tarreau <w@1wt.eu>, Matthew Garrett <mjg59@srcf.ucam.org>,
Ext4 Developers List <linux-ext4@vger.kernel.org>,
linux-man <linux-man@vger.kernel.org>
Subject: Re: [PATCH v3 0/8] Rework random blocking
Date: Thu, 26 Dec 2019 10:29:00 +0100 [thread overview]
Message-ID: <9872655.prSdhymlXK@positron.chronox.de> (raw)
In-Reply-To: <cover.1577088521.git.luto@kernel.org>
Am Montag, 23. Dezember 2019, 09:20:43 CET schrieb Andy Lutomirski:
Hi Andy,
>
> There are some open questions and future work here:
>
> Should the kernel provide an interface to get software-generated
> "true random" numbers? I can think of only one legitimate reason to
> use such an interface: compliance with government standards. If the
> kernel provides such an interface going forward, I think it should
> be a brand new character device, and it should have a default mode
> 0440 or similar. Software-generated "true random numbers" are a
> very limited resource, and resource exhaustion is a big deal. Ask
> anyone who has twiddled their thumbs while waiting for gnupg to
> generate a key. If we think the kernel might do such a thing, then
> patches 5-8 could be tabled for now.
What about offering a compile-time option to enable or disable such code?
Note, with the existing random.c code base, there is no need to have a
separate blocking_pool. The ChaCha20 DRNG could be used for that very same
purpose, provided that in case these true random numbers are generated when
the Chacha20 DRNG received an equal amount of "unused" entropy.
>
> Alternatively, perhaps the kernel should instead provide a
> privileged interface to read out raw samples from the various
> entropy sources, and users who care could have a user daemon that
> does something intelligent with them. This would push the mess of
> trying to comply with whatever standards are involved to userspace.
> Userspace could then export "true randomness" via CUSE if it is so
> inclined, or could have a socket with a well-known name, or whatever
> else seems appropriate.
With the patch set v26 of my LRNG I offer another possible alternative
avoiding any additional character device file and preventing the starvation of
legitimate use cases: the LRNG has an entropy pool that leaves different
levels of entropy in the pool depending on the use cases of this data.
If an unprivileged caller requests true random data, at least 1024 bits of
entropy is left in the pool. I.e. all entropy above that point is available
for this request type. Note, even namespaces fall into this category
considering that unprivileged users can create a user name space in which they
can become root.
If a non-blocking DRNG serving /dev/urandom or getrandom(2) needs reseeding,
at least 512 bits of entropy is left in the pool. Each DRNG seeding operation
requires at least 128 bits and at most 256 bits of entropy. This means that at
least 2 reseed operations worth of entropy is found in the entropy pool even
though massive amount of true random numbers are requested by unprivileged
users.
If a privileged caller requests true random numbers, the entropy pool is
allowed to be exhausted.
Access to the true random number generator is provided with getrandom(2) and
the GRND_TRUERANDOM flag. If the true random number generator (TRNG) is not
compiled or not present, -EOPNOTSUPP is returned.
Entire patch set:
Reviewed-by: Stephan Müller <smueller@chronox.de>
Ciao
Stephan
next prev parent reply other threads:[~2019-12-26 9:35 UTC|newest]
Thread overview: 39+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-12-23 8:20 [PATCH v3 0/8] Rework random blocking Andy Lutomirski
2019-12-23 8:20 ` [PATCH v3 1/8] random: Don't wake crng_init_wait when crng_init == 1 Andy Lutomirski
2020-01-07 20:42 ` Theodore Y. Ts'o
2019-12-23 8:20 ` [PATCH v3 2/8] random: Add a urandom_read_nowait() for random APIs that don't warn Andy Lutomirski
2020-01-07 20:43 ` Theodore Y. Ts'o
2019-12-23 8:20 ` [PATCH v3 3/8] random: Add GRND_INSECURE to return best-effort non-cryptographic bytes Andy Lutomirski
2020-01-07 20:44 ` Theodore Y. Ts'o
2019-12-23 8:20 ` [PATCH v3 4/8] random: Ignore GRND_RANDOM in getentropy(2) Andy Lutomirski
2020-01-07 20:44 ` Theodore Y. Ts'o
2019-12-23 8:20 ` [PATCH v3 5/8] random: Make /dev/random be almost like /dev/urandom Andy Lutomirski
2020-01-07 21:02 ` Theodore Y. Ts'o
2019-12-23 8:20 ` [PATCH v3 6/8] random: Remove the blocking pool Andy Lutomirski
2020-01-07 21:03 ` Theodore Y. Ts'o
2019-12-23 8:20 ` [PATCH v3 7/8] random: Delete code to pull data into pools Andy Lutomirski
2020-01-07 21:03 ` Theodore Y. Ts'o
2019-12-23 8:20 ` [PATCH v3 8/8] random: Remove kernel.random.read_wakeup_threshold Andy Lutomirski
2020-01-07 21:04 ` Theodore Y. Ts'o
2019-12-26 9:29 ` Stephan Müller [this message]
2019-12-26 10:03 ` [PATCH v3 0/8] Rework random blocking Matthew Garrett
2019-12-26 11:40 ` Stephan Mueller
2019-12-26 11:12 ` Andy Lutomirski
2019-12-26 12:03 ` Stephan Mueller
2019-12-26 12:46 ` Andy Lutomirski
2019-12-27 9:55 ` Stephan Mueller
2019-12-26 14:04 ` Theodore Y. Ts'o
2019-12-26 23:29 ` Andy Lutomirski
2019-12-27 10:29 ` Stephan Mueller
2019-12-27 13:04 ` Theodore Y. Ts'o
2019-12-27 21:22 ` Stephan Mueller
2019-12-27 22:08 ` Theodore Y. Ts'o
2019-12-28 2:06 ` Andy Lutomirski
2019-12-29 14:49 ` Theodore Y. Ts'o
2019-12-29 15:08 ` Andy Lutomirski
2019-12-28 7:01 ` Willy Tarreau
2020-01-09 22:02 ` Kurt Roeckx
2020-01-09 22:40 ` Theodore Y. Ts'o
2020-01-09 23:02 ` Kurt Roeckx
2020-01-10 7:53 ` Stephan Mueller
2020-01-10 0:30 ` Andy Lutomirski
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=9872655.prSdhymlXK@positron.chronox.de \
--to=smueller@chronox.de \
--cc=Jason@zx2c4.com \
--cc=darwish.07@gmail.com \
--cc=ebiederm@xmission.com \
--cc=keescook@chromium.org \
--cc=linux-api@vger.kernel.org \
--cc=linux-ext4@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-man@vger.kernel.org \
--cc=luto@kernel.org \
--cc=mjg59@srcf.ucam.org \
--cc=mtk.manpages@gmail.com \
--cc=mzxreary@0pointer.de \
--cc=patrakov@gmail.com \
--cc=tytso@mit.edu \
--cc=w@1wt.eu \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).