Entropy woes
Hezekiah <[email protected]> Mon, 3 Mar 2003 20:37:58 -0500
| Newsgroups | gmane.comp.security.invisiblenet.iip.devel |
|---|---|
| Message-ID | <[email protected]> |
Hi, all! :) Well, I took a look into the new entropy problem, and I think the chances of me turning into a llama are getting higher. Here's what I managed to pull together. If "randomentropyneeded" is nonzero, and isproxy is run with -R or -C, then isproxy asks the user for entropy. (If isproxy is run without -R or -C, and isproxy.ini is complete, then isproxy should just abort and tell the user to run it with -R.) Anyway, it would make sense that once the user has provided entropy, that "randomentropyneeded" would be set to 0, and that at some point (probably when the isproxy quits) seed.rnd would be written. As far as I have been able to tell, neither of those two things happen. "randomentropyneeded" is only set in two functions in crypt/random.c: randomWriteSeed() and randomReadSeed(). After uiGetEntropy() (that's the function that asks the user to provide entropy) is called, under certain conditions randomReadSeed() is called; randomWriteSeed() appears to never be called (more on that later). Unfortunately, randomReadSeed() will fail because seed.rnd doesn't exist. Thus, it appears that "randomentropyneeded" never gets set to 0. So when it gets tested again in init(), the test fails and isproxy aborts just like how mids experienced. This most BIZZARE thing about all of this is that it appears that randomWriteSeed() never gets called. The only exception is a call by randomSlowPoolReseed(), and randomSlowPoolReseed() really never gets called. (Note: I might have missed a call-by-function-pointer or something like that, but it sure looks like randomWriteSeed() is dead code.) If randomWriteSeed() really never is called during the execution of IIP, then seed.rnd never gets updated (or written in the first place), and THAT would be bad! :( Anyway, I'm officially weirded out by all of this. I'm probably missing something deep (or not so deep) in the bowels of the IIP code. UserX? nop? Want to enlighten this poor soul? :) -- Hezekiah
signature.asc
(application/pgp-signature, 189 B)
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) iD8DBQA+ZAOPeHiZTMH32ioRAsELAKCEKXgpiGCFlhSqegykOlselTgU5QCfbbAm /+aFIybRjqScePsJ+Wfx//E= =sd0g -----END PGP SIGNATURE-----