Entropy woes

Hezekiah <[email protected]> Mon, 3 Mar 2003 20:37:58 -0500
Newsgroups gmane.comp.security.invisiblenet.iip.devel
Message-ID <[email protected]>
Hi, all! :)
	Well, I took a look into the new entropy problem, and I think the chances of 
me turning into a llama are getting higher. Here's what I managed to pull 
together.

	If "randomentropyneeded" is nonzero, and isproxy is run with -R or -C, then 
isproxy asks the user for entropy. (If isproxy is run without -R or -C, and 
isproxy.ini is complete, then isproxy should just abort and tell the user to 
run it with -R.)
	Anyway, it would make sense that once the user has provided entropy, that 
"randomentropyneeded" would be set to 0, and that at some point (probably 
when the isproxy quits) seed.rnd would be written. As far as I have been able 
to tell, neither of those two things happen.
	"randomentropyneeded" is only set in two functions in crypt/random.c: 
randomWriteSeed() and randomReadSeed(). After uiGetEntropy() (that's the 
function that asks the user to provide entropy) is called, under certain 
conditions randomReadSeed() is called; randomWriteSeed() appears to never be 
called (more on that later). Unfortunately, randomReadSeed() will fail 
because seed.rnd doesn't exist. Thus, it appears that "randomentropyneeded" 
never gets set to 0. So when it gets tested again in init(), the test fails 
and isproxy aborts just like how mids experienced.
	This most BIZZARE thing about all of this is that it appears that 
randomWriteSeed() never gets called. The only exception is a call by 
randomSlowPoolReseed(), and randomSlowPoolReseed() really never gets called. 
(Note: I might have missed a call-by-function-pointer or something like that, 
but it sure looks like randomWriteSeed() is dead code.) If randomWriteSeed() 
really never is called during the execution of IIP, then seed.rnd never gets 
updated (or written in the first place), and THAT would be bad! :(
	Anyway, I'm officially weirded out by all of this. I'm probably missing 
something deep (or not so deep) in the bowels of the IIP code. UserX? nop? 
Want to enlighten this poor soul? :)

	-- Hezekiah
signature.asc (application/pgp-signature, 189 B)
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iD8DBQA+ZAOPeHiZTMH32ioRAsELAKCEKXgpiGCFlhSqegykOlselTgU5QCfbbAm
/+aFIybRjqScePsJ+Wfx//E=
=sd0g
-----END PGP SIGNATURE-----