Changes to make /dev/*random better sooner
Thor Lancelot Simon <[email protected]> Tue, 8 Apr 2014 00:25:32 -0400
| Newsgroups | gmane.os.netbsd.devel.kernel,gmane.os.netbsd.devel.crypto |
|---|---|
| Message-ID | <[email protected]> |
Attached are the changes from the tls-earlyentropy branch, which tries
to make the output of /dev/random less predictable -- particularly for
an attacker outside the box -- earlier.
I intend to merge these soon. Comment would be much appreciated.
The commit messages from this branch:
Log Message:
RNDVERBOSE kernel for testing.
Log Message:
LZF in the kernel. As an entropy estimator for now but it's very small, and
we could use it for ipcomp, for hibernation, for paging, for core dumps, etc.
Log Message:
Entropy estimation changes:
1) Avoid wraparound problems with delta estimator by making estimation
framework 64-bit.
2) Adjust rnd_counter to always return a 64-bit value, accordingly.
3) Make delta estimator generic and create two instances: delta-time and
delta-value.
4) Add LZF estimator -- used mostly to protect us against injection of
bulk data we think is random but is really constant.
5) Allow value and time estimation/collection to be controlled separately.
6) Expose estimator performance to userspace.
Log Message:
Get more entropy into the system early:
1) Add device attach timings from autoconf.
2) Accumulate the output of kernel printf (as well as the times
when it's called) and add this periodically. To avoid issues
with recursion through diagnostic printfs, we use SHA512 to
accumulate the printf output, then mix in its output.
3) Add all sysctl settings -- mixes in the hostname and likely a
bit more.
Log Message:
Increase unpredictability of early output: mix in the headers of the
first 100 Ethernet packets received by the system (if we are really
short of entropy, keep mixing them though we don't count any entropy from
them; such systems are particularly likely to have guessable outputs).
Log Message:
Update rndctl(8) to add the -v option, which gives us more robust information
on entropy collection and estimation.
Log Message:
Whups. It'd help to check in the ioctl changes needed to support that
rndctl change just prior... ;-)
Log Message:
Be a little more clear and consistent about harvesting entropy from devices:
1) deprecate RND_FLAG_NO_ESTIMATE
2) define RND_FLAG_COLLECT_TIME, RND_FLAG_COLLECT_VALUE
3) define RND_FLAG_ESTIMATE_TIME, RND_FLAG_ESTIMATE_VALUE
4) define RND_FLAG_DEFAULT: RND_FLAG_COLLECT_TIME|
RND_FLAG_COLLECT_VALUE|RND_FLAG_ESTIMATE_TIME
5) Make entropy harvesting from environmental sensors a little more generic
and remove it from individual sensor drivers.
6) Remove individual open-coded delta-estimators for values from a few
places in the tree (uvm, environmental drivers).
7) 0 -> RND_FLAG_DEFAULT, actually gather entropy from various drivers
that had stubbed out code, other minor cleanups.
Log Message:
Fix t_subr_prf.c -- such as is possible. I am not so sure about the idea of
tearing apart a source file with a script in order to "test" pieces of it...
earlyentropy.diff
(text/plain, 166.9 KB) - not displayed