TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

Entropy and the NetBSD Kernel

43 pointsby jayp1418about 5 years ago

7 comments

als0about 5 years ago
&gt; My goal was to ensure that we have collected from as many potential sources of randomness as possible to ensure a quality initial seed for userspace random number generators. So, it includes everything, including sources considered &quot;low value&quot;, like interrupt timings.<p>While a TRNG is fundamentally necessary for initial entropy, it is generally a good idea to mix as much other randomness as possible to reduce your dependency on a single source, in case that single source turns out to be biased. So I agree with the author that there is still some value in the &quot;low value&quot; options.
loegabout 5 years ago
If you like this sort of thing, here&#x27;s a zoo of other designs:<p>* <a href="http:&#x2F;&#x2F;aka.ms&#x2F;win10rng" rel="nofollow">http:&#x2F;&#x2F;aka.ms&#x2F;win10rng</a> (Windows 10, PDF)<p>* <a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Fortuna_(PRNG)" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Fortuna_(PRNG)</a> (FreeBSD)<p>* <a href="https:&#x2F;&#x2F;csrc.nist.gov&#x2F;publications&#x2F;detail&#x2F;sp&#x2F;800-90a&#x2F;rev-1&#x2F;final" rel="nofollow">https:&#x2F;&#x2F;csrc.nist.gov&#x2F;publications&#x2F;detail&#x2F;sp&#x2F;800-90a&#x2F;rev-1&#x2F;f...</a> (NIST)<p>* <a href="https:&#x2F;&#x2F;github.com&#x2F;torvalds&#x2F;linux&#x2F;blob&#x2F;master&#x2F;drivers&#x2F;char&#x2F;random.c#L55-L307" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;torvalds&#x2F;linux&#x2F;blob&#x2F;master&#x2F;drivers&#x2F;char&#x2F;r...</a> (Linux; I could not find a separate design document as such. Perhaps the best design reference is this block comment at the beginning of the file implementing it)
CJeffersonabout 5 years ago
Picking on one point, I think the name of the hardware is a fair thing to chuck in the pool.<p>As this article says, early in the process you often have several soirces of low quality, and all we can do is hope to get the best we can from anywhere we can. The name and versions of everything attached is fairly horrible entropy, but it doesn&#x27;t hurt.
评论 #23212253 未加载
评论 #23212194 未加载
throwaway2048about 5 years ago
I think OpenBSD has an interesting solution to this problem, randomness is saved in a seedfile on shutdown&#x2F;periodically during runtime, and injected directly into the kernel via boot loader before the kernel loads.<p>This gives you a quality of randomness as early as possible during kernel boot, and allows you to employ it with kernel structures that are otherwise impossible to modify post-initialization (that say may be required to get &quot;randomness harvesting&quot; working).
评论 #23212892 未加载
评论 #23216630 未加载
评论 #23213170 未加载
评论 #23212624 未加载
jayp1418about 5 years ago
More is being discussed here at mailing list thread <a href="https:&#x2F;&#x2F;mail-index.netbsd.org&#x2F;tech-userlevel&#x2F;2020&#x2F;05&#x2F;02&#x2F;msg012333.html" rel="nofollow">https:&#x2F;&#x2F;mail-index.netbsd.org&#x2F;tech-userlevel&#x2F;2020&#x2F;05&#x2F;02&#x2F;msg0...</a>
cipher_314159about 5 years ago
A couple of considerations:<p>Regarding the hostname thing, the NISP SP800-90Ar1 specs for PRNGs include &quot;personalization strings&quot; as an optional part of the initialization. Lots of other systems have similar parameters. The fundamental idea is that randomness sources are sometimes subject to failure, especially as you ask for more and more random data (e.g., until recently, &#x2F;dev&#x2F;random on Linux would block if it &quot;didn&#x27;t have enough entropy&quot;, and there have been plenty of issues related to code NOT CHECKING for short reads). The NIST spec suggests using things like serial numbers, user IDs, MAC addresses, software versions, timestamps, module and applications, even random numbers derived from other sources as parts of the personalization string. The idea is that each PRNG created will always have at least one unique input to it, so you at least avoid repeated outputs if the seeds and the nonces get hosed up.<p>So there&#x27;s a case to be made for hauling in low-randomness data, even if it doesn&#x27;t help accumulate enough randomness. The hostname certainly isn&#x27;t perfect (think of all those Raspberry Pis with the same hostname), but it doesn&#x27;t HURT as long as we&#x27;re honest about what that input is providing (distinction versus randomness).<p>Also: the author notes that some of the random sources they tested are highly biased. While biased output from a random source isn&#x27;t GREAT, it isn&#x27;t necessarily a showstopper. The key thing for security in this context is not a lack of bias, but a lack of predictability. Suppose I have a biased random source, with a 1&#x2F;3 probability of outputting a 1, and a 2&#x2F;3 probability of outputting a 0. If there&#x27;s nobody out there who can predict the NEXT output with probability greater than 2&#x2F;3 (i.e., it&#x27;s not backdoored or subject to some nasty attack), then it&#x27;s just fine as a random source. We just can&#x27;t treat each bit we read as providing a &quot;full bit&quot; of random into the system. In the example above, you could just seed your 256-bit PRNG with about 280 bits of biased input. Alternatively, you could just do the old &quot;read twice: discard if results match; otherwise take the first value&quot; trick to get an unbiased source.<p>Also, it&#x27;s important to remember that &quot;entropy&quot; in these conversations is used in a squishy way, and it&#x27;s easy to mix up different definitions of the term. Folks talking about &quot;entropy&quot; in the context of PRNGs usually mean unpredictability, unstructuredness, unrecoverability, or some combination thereof. They typically do <i>not</i> mean Shannon entropy, which is essentially a measure of UNIFORMITY of output . If you feed the numbers 0 through 255-- in order-- into an entropy calculator, it will report exactly 8 bits of entropy, even though the input was clearly structured and predictable. That&#x27;s why I&#x27;ve tried to avoid using the term &quot;entropy&quot; and focus on &quot;random&quot; or &quot;randomness&quot;.<p>As for backdoors-- it&#x27;s theoretically possible that things like RDRAND or a USB key or whatever can be compromised. Standard, non-dedicated randomness inputs (like keystroke timing, network packet arrival times, disk I&#x2F;O info, interrupt timing, clock drift, etc.) are still included in OS PRNGs, and PRNG state is periodically updated to fold in that randomness. While it isn&#x27;t EASY for a hardware backdoor to overcome this, it&#x27;s theoretically possible, and it only takes a small amount of influence to create some devastating effects. Dan Bernstein wrote an article back in 2014 about the hardware backdoor idea; one very simple suggestion that he made was to simply design cryptosystems to use LESS random data (his Ed25519 system generates nonces deterministically, for instance).
评论 #23216596 未加载
评论 #23214777 未加载
29athrowawayabout 5 years ago
Buy a hardware source of entropy.
评论 #23214026 未加载
评论 #23214156 未加载
评论 #23227409 未加载