TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Linux RNG flaws

182 点作者 tbodt大约 7 年前

9 条评论

tytso大约 7 年前
The flaws only applied for keys generated during early boot. Jann and I looked, but we didn&#x27;t find a way that this could be turned into a practical exploit, which is why we considered, but decided against, doing any kind of coordinated disclosure. The potential weakness applies before you see crng_init=2 message, and in practice on many machines this happens well before a minute --- on my laptop, in under 10 seconds.<p>The main problem with the fix is that there are some userspace applications which assumed they could get cryptographic randomness super-early during system startup, and with a patched kernel, those userspace applications would block --- and in some cases, block the boot altogether. With no activity, there is no entropy to harness, and the boot scripts essentially deadlock waiting for the random pool to be initialized.<p>So for some hardware, and some distributions, we&#x27;re getting some boot hangs that we now need to try to workaround or fix somehow. In general, the best thing to do is not to rely on cryptographic strength random number generation during early boot. Key generation should be done lazily, and deferred for as long as possible.
评论 #16974436 未加载
评论 #16977138 未加载
评论 #16975533 未加载
评论 #16974697 未加载
评论 #16975088 未加载
评论 #16974431 未加载
jlgaddis大约 7 年前
On RHEL 7 (and derivatives), by default, SSH keys are generated on first boot and with entropy acquired from &#x2F;dev&#x2F;urandom.<p>It is possible, however, to force it sshd-keygen, sshd, et al., to use &#x2F;dev&#x2F;random instead (by setting &quot;SSH_USE_STRONG_RNG&quot; in &#x2F;etc&#x2F;sysconfig&#x2F;sshd to a value &gt;= 14). In this case, would keys still potentially be at risk?<p>---<p>For a while now, I&#x27;ve been generating my SSH host keys at the end of the kickstart installation process (for physical hosts) with SSH_USE_STRONG_RNG=32 (in a &quot;%post&quot; script).<p>Virtual guests (KVM) still generate theirs on first boot, but they have the benefit of access to the host&#x27;s &#x2F;dev&#x2F;random and also get a random seed &quot;injected&quot; into their disk image just before first boot -- although I&#x27;m not sure if that helps with this issue.
champtar大约 7 年前
Just to be sure I understand fully, if I take a small embedded router running OpenWRT, that maybe take ~1min for the urandom pool to be ready. <a href="https:&#x2F;&#x2F;git.openwrt.org&#x2F;?p=openwrt&#x2F;openwrt.git;a=commitdiff;h=3946a5529132c80793a9e5ee665a3cd6b0835310;hp=e408abd7fb8e2a8842726345f393236c53496933" rel="nofollow">https:&#x2F;&#x2F;git.openwrt.org&#x2F;?p=openwrt&#x2F;openwrt.git;a=commitdiff;...</a> On the first boot we save 512 bytes from getrandom(). On the second boot we restore the seed (cat seed &gt; &#x2F;dev&#x2F;urandom) before almost all the user space starts. Many daemons (dropbear&#x2F;openvpn) will read from &#x2F;dev&#x2F;urandom before urandom pool is considered ready, but after the seed is restored.<p>With the new patches, are the daemons benefiting from the seed ?
评论 #16974833 未加载
nikic大约 7 年前
Seeing that `i % len` in <a href="https:&#x2F;&#x2F;git.kernel.org&#x2F;pub&#x2F;scm&#x2F;linux&#x2F;kernel&#x2F;git&#x2F;torvalds&#x2F;linux.git&#x2F;commit&#x2F;drivers&#x2F;char&#x2F;random.c?id=dc12baacb95f205948f64dc936a47d89ee110117" rel="nofollow">https:&#x2F;&#x2F;git.kernel.org&#x2F;pub&#x2F;scm&#x2F;linux&#x2F;kernel&#x2F;git&#x2F;torvalds&#x2F;lin...</a> makes me uncomfortable. This is performing a non-constant modulus on every loop iteration, which seems quite excessive even for a slow path. Performing wraparounds using a separate branch would be more efficient.
评论 #16976568 未加载
评论 #16982043 未加载
loeg大约 7 年前
It&#x27;s worth noting that FreeBSD also had some RNG troubles quite recently (2017)[0] (talk: [1]). Personally, I don&#x27;t think they were as severe as this. (But I am biased, I do FreeBSD development.) What I&#x27;m trying to say is, getting random right is hard. It&#x27;s easy to produce something random-looking that isn&#x27;t good enough.<p>JMG&#x27;s FreeBSD 2017 RNG talk Tl;dr:<p>1. Boot-time entropy might leak on either UFS or ZFS; might be re-used in a byzantine ZFS environment. (Not addressed, as far as I know.)<p>2. Input entropy data (pre-whitening) had only about 0.18 bits of entropy per byte of input. NIST likes to see 4-6 bits per byte. (Not really an issue due to sufficient input volume.) Partially due to:<p>3. All the fast, high-quality sources of random entropy were accidentally disabled(!). (All the PURE_* ones, including x86 RDRAND.) Fixed in r324394.<p>4. Other low entropy structures were getting mixed in. Probably harmless, but reduces entropy-per-byte measure that NIST cares about. Fixed in r324372.<p>The earlier 2015 FreeBSD RNG issues were probably as severe as this Linux issue[2]:<p>&gt; URGENT: RNG broken for last 4 months<p>&gt; If you are running a current kernel r273872 or later, please upgrade your kernel to r278907 or later immediately and regenerate keys.<p>&gt; I discovered an issue where the new framework code was not calling randomdev_init_reader, which means that read_random(9) was not returning good random data. read_random(9) is used by arc4random(9) which is the primary method that arc4random(3) is seeded from.<p>&gt; This means most&#x2F;all keys generated may be predictable and must be regenerated. This includes, but not limited to, ssh keys and keys generated by openssl. This is purely a kernel issue, and a simple kernel upgrade w&#x2F; the patch is sufficient to fix the issue.<p>[0]: <a href="https:&#x2F;&#x2F;www.funkthat.com&#x2F;~jmg&#x2F;vbsdcon_2017_ddfreebsdrng_slides.pdf" rel="nofollow">https:&#x2F;&#x2F;www.funkthat.com&#x2F;~jmg&#x2F;vbsdcon_2017_ddfreebsdrng_slid...</a><p>[1]: <a href="https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=A41cDCE6pTc" rel="nofollow">https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=A41cDCE6pTc</a><p>[2]: <a href="https:&#x2F;&#x2F;lists.freebsd.org&#x2F;pipermail&#x2F;freebsd-current&#x2F;2015-February&#x2F;054580.html" rel="nofollow">https:&#x2F;&#x2F;lists.freebsd.org&#x2F;pipermail&#x2F;freebsd-current&#x2F;2015-Feb...</a>
dmateos大约 7 年前
4795 b2242bd 30230fc 9fb6ae d7 7d 69 69 73 69 69 69 69 69 69 69 73 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 6e 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 69 5140 f a a a 5 a a a a 5 a<p>Nice.
snissn大约 7 年前
Tldr?
评论 #16973764 未加载
评论 #16973697 未加载
评论 #16973699 未加载
lihes大约 7 年前
man urandom<p>&gt; When read during early boot time, &#x2F;dev&#x2F;urandom may return data prior to the entropy pool being initialized.<p>I see no bugs here. Just repeating what is written in the man page.
评论 #16977264 未加载
评论 #16975771 未加载
评论 #16975387 未加载
John_KZ大约 7 年前
Wasn&#x27;t there a popular article with the author vehemently supporting the use of &#x2F;dev&#x2F;urandom because of it&#x27;s nonblocking characteristics? I vividly remember it.<p>Also I think it&#x27;s common knowledge that there&#x27;s little entropy available during startup but developers have no control over it regardless.<p>I <i>didn&#x27;t</i> know it was <i>that</i> bad though. That&#x27;s really bad.