Date: Mon, 10 Sep 2012 12:21:15 -0700 From: Doug Barton <dougb@FreeBSD.org> To: =?ISO-8859-1?Q?Dag-Erling_Sm=F8rgrav?= <des@des.no> Cc: Arthur Mesh <arthurmesh@gmail.com>, freebsd-rc@freebsd.org, obrien@freebsd.org, freebsd-security@freebsd.org, RW <rwmaillists@googlemail.com>, Xin Li <delphij@delphij.net> Subject: Re: svn commit: r239569 - head/etc/rc.d Message-ID: <504E3DAB.3090000@FreeBSD.org> In-Reply-To: <86pq5tu1zr.fsf@ds4.des.no> References: <50450F2A.10708@FreeBSD.org> <20120903203505.GN1464@x96.org> <50451D6E.30401@FreeBSD.org> <20120903214638.GO1464@x96.org> <50453686.9090100@FreeBSD.org> <20120904220754.GA3643@server.rulingia.com> <20120906174247.GB13179@dragon.NUXI.org> <20120906230157.5307a21f@gumby.homeunix.com> <20120906224703.GD89120@x96.org> <20120907015157.GA29497@server.rulingia.com> <20120910135218.GA68128@dragon.NUXI.org> <504E343A.4020802@FreeBSD.org> <86pq5tu1zr.fsf@ds4.des.no>
next in thread | previous in thread | raw e-mail | index | archive | help
On 9/10/2012 12:11 PM, Dag-Erling Smørgrav wrote:
> Doug Barton <dougb@FreeBSD.org> writes:
>> As I have repeated many times now, BEFORE YOU MAKE ANY MORE CHANGES I AM
>> ASKING YOU TO DO THE TESTING TO VERIFY YOUR CLAIMS.
>
> And here's the million-dollar question... how? Boot a VM a million
> times, save the first 4096 bytes that come out of /dev/random at every
> boot, and look for correlation?
If the problem with replay attacks is as bad as Arthur suggest it is, it
should be visible in far less than a million tries.
For the "how much entropy makes it into the pool" question instrumenting
the code should do the trick.
My point being that we have 12 years of successful operation, with no
one (TMK) complaining that they have actually _seen_ the alleged
problems in action. Now we have claims that major problems exist,
requiring drastic changes in the system. As I have said before, it would
be bad engineering to make these changes without proof under any
circumstances. Even more so given that /dev/random is (in some senses) a
security tool.
Doug
--
I am only one, but I am one. I cannot do everything, but I can do
something. And I will not let what I cannot do interfere with what
I can do.
-- Edward Everett Hale, (1822 - 1909)
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?504E3DAB.3090000>