From owner-freebsd-security@FreeBSD.ORG Wed Sep 19 20:53:13 2012 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id B16B5106568A for ; Wed, 19 Sep 2012 20:53:13 +0000 (UTC) (envelope-from pawel@dawidek.net) Received: from mail.dawidek.net (garage.dawidek.net [91.121.88.72]) by mx1.freebsd.org (Postfix) with ESMTP id 72E258FC0A for ; Wed, 19 Sep 2012 20:53:13 +0000 (UTC) Received: from localhost (89-73-195-149.dynamic.chello.pl [89.73.195.149]) by mail.dawidek.net (Postfix) with ESMTPSA id A0CD24C1; Wed, 19 Sep 2012 22:52:17 +0200 (CEST) Date: Wed, 19 Sep 2012 22:53:32 +0200 From: Pawel Jakub Dawidek To: Jonathan Anderson Message-ID: <20120919205331.GE1416@garage.freebsd.pl> References: <20120918211422.GA1400@garage.freebsd.pl> <20120919192923.GA1416@garage.freebsd.pl> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="NY6JkbSqL3W9mApi" Content-Disposition: inline In-Reply-To: <20120919192923.GA1416@garage.freebsd.pl> X-OS: FreeBSD 10.0-CURRENT amd64 User-Agent: Mutt/1.5.21 (2010-09-15) X-Mailman-Approved-At: Wed, 19 Sep 2012 21:07:06 +0000 Cc: freebsd-security@freebsd.org, Mariusz Gromada Subject: Re: Collecting entropy from device_attach() times. X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 19 Sep 2012 20:53:13 -0000 --NY6JkbSqL3W9mApi Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Wed, Sep 19, 2012 at 09:29:23PM +0200, Pawel Jakub Dawidek wrote: > On Wed, Sep 19, 2012 at 07:30:52PM +0100, Jonathan Anderson wrote: > > > If all the times are more or less equally probable in this range [=E2= =80=A6] > >=20 > > They're very unlikely to be equally probable. It would make sense to do= some characterization of these times and their statistics: a highly non-un= iform distribution would mean that we don't actually get many bits per atta= ch. >=20 > I have times for ~2000 device_attach() calls when loading sound card > driver on totally idle system. If someone could take those and analyse > the distribution that would be great. >=20 > > > [=E2=80=A6] we have more > > > than 19 bits of entropy from this one call, but I reduced if to four > > > bits only, because there are devices that are much faster to attach. > > > =20 > >=20 > > Another reason for doing the above characterization is that, if a parti= cular device_attach() really does provide 12 bits of uncertainty, it's a sh= ame to drop eight of them on the floor. >=20 > Right. That's why I've prepared another patch: >=20 > http://people.freebsd.org/~pjd/patches/harvest_device_attach.2.patch >=20 > which effectively discards top ten bits, which means we expect 0.1% of > the attach time to be unpredictable (the attach time in most cases vary > by few percent, not sure yet how much of this variation is really > unpredictable). Here's how the distribution looks like for device_attach() times of my sound card. The times were 26bit numbers, so this is after discarding top ten bits, which leave us with 16 lower bits of pure entropy:) http://people.freebsd.org/~pjd/misc/harvest_device_attach.png Kudos to my friend Mariusz (CCed) who is mathematician and who helped me with visualization and also promissed to prepare formal proof:) --=20 Pawel Jakub Dawidek http://www.wheelsystems.com FreeBSD committer http://www.FreeBSD.org Am I Evil? Yes, I Am! http://tupytaj.pl --NY6JkbSqL3W9mApi Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.19 (FreeBSD) iEYEARECAAYFAlBaMMsACgkQForvXbEpPzRvowCcCvvBJ0zDqwcQLhF4SkV7y/q7 xDoAoL5EuvVBtK8ivwKC38i+oHUtHX3E =s4nF -----END PGP SIGNATURE----- --NY6JkbSqL3W9mApi--