AW: ENTROPY EXHAUSTION IN JAVA FIPS

Lothar, that might have been true in the past (especially where the daemons=
 only fed /dev/urandom into /dev/random). However both daemons do (meanwhil=
e) more than that (i.e. sampling CPU jitter or mixing in hwrandom). For thi=
s reason ist not only a "unblocking" but also really increasing unpredictab=
litiy oft he kernel random state.

However it does not hurt do do all 3, use bybrid, use /dev/unrandom and run=
 the rng daemons.

(side note: even if you only feed dev/urandom into the entropy pool it woul=
d increase unpredictability since linux XORs all urandom reads with RDRAND =
which should be available on most CPUs).

Gruss
Bernd
-----Urspr=FCngliche Nachricht-----
Von: Lothar Kimmeringer <[email protected]>
Gesendet: Mittwoch, 30. Oktober 2019 12:37
An: [email protected]
Betreff: Re: [dev-crypto] ENTROPY EXHAUSTION IN JAVA FIPS

Hi,

Am 30.10.2019 um 11:41 schrieb Eckenfels. Bernd:

> It might be a work around, [using haveged or rng-tools]
>
> In my experience this avoids blocking /dev/random

It helps for a local system but if you provide a software you expect custom=
ers to install on their own systems it's a bad start for a discussion if th=
e reason is that a mission critical production system stopped working due t=
o a blocked /dev/random.

Using haveged as a work around for a blocking /dev/random is esentially adm=
itting that the randomness of /dev/random and /dev/urandom are of the same =
quality and that it's enough for your needs (which I state is the case for =
>99.9% of current uses of BouncyCastle "out there"). Same for rng-tools wit=
hout some random number generator available to it.


Cheers, Lothar









SEEBURGER AG            Vorstand/SEEBURGER Executive Board:
Sitz der Gesellschaft/Registered Office:                Axel Haas, Michael =
Kleeberg, Axel Otto, Dr. Martin Kuntz, Matthias Fe=DFenbecker
Edisonstr. 1
D-75015 Bretten         Vorsitzende des Aufsichtsrats/Chairperson of the SE=
EBURGER Supervisory Board:
Tel.: 07252 / 96 - 0            Prof. Dr. Simone Zeuchner
Fax: 07252 / 96 - 2222
Internet: http://www.seeburger.de               Registergericht/Commercial =
Register:
e-mail: [email protected]               HRB 240708 Mannheim


Dieses E-Mail ist nur f=FCr den Empf=E4nger bestimmt, an den es gerichtet i=
st und kann vertrauliches bzw. unter das Berufsgeheimnis fallendes Material=
 enthalten. Jegliche darin enthaltene Ansicht oder Meinungs=E4u=DFerung ist=
 die des Autors und stellt nicht notwendigerweise die Ansicht oder Meinung =
der SEEBURGER AG dar. Sind Sie nicht der Empf=E4nger, so haben Sie diese E-=
Mail irrt=FCmlich erhalten und jegliche Verwendung, Ver=F6ffentlichung, Wei=
terleitung, Abschrift oder jeglicher Druck dieser E-Mail ist strengstens un=
tersagt. Weder die SEEBURGER AG noch der Absender (Eckenfels. Bernd) =FCber=
nehmen die Haftung f=FCr Viren; es obliegt Ihrer Verantwortung, die E-Mail =
und deren Anh=E4nge auf Viren zu pr=FCfen.


This email is intended only for the recipient(s) to whom it is addressed. T=
his email may contain confidential material that may be protected by profes=
sional secrecy. Any fact or opinion contained, or expression of the materia=
l herein, does not necessarily reflect that of SEEBURGER AG. If you are not=
 the addressee or if you have received this email in error, any use, public=
ation or distribution including forwarding, copying or printing is strictly=
 prohibited. Neither SEEBURGER AG, nor the sender (Eckenfels. Bernd) accept=
 liability for viruses; it is your responsibility to check this email and i=
ts attachments for viruses.