Skip site navigation (1)Skip section navigation (2)
Date:      Mon, 3 Sep 2012 13:35:05 -0700
From:      Arthur Mesh <arthurmesh@gmail.com>
To:        Doug Barton <dougb@FreeBSD.org>
Cc:        freebsd-security@FreeBSD.org, freebsd-rc@FreeBSD.org, Mark Murray <markm@FreeBSD.org>, "David E. O'Brien" <obrien@FreeBSD.org>
Subject:   Re: svn commit: r239569 - head/etc/rc.d
Message-ID:  <20120903203505.GN1464@x96.org>
In-Reply-To: <50450F2A.10708@FreeBSD.org>
References:  <201208221843.q7MIhLU4077951@svn.freebsd.org> <5043DBAF.40506@FreeBSD.org> <20120903171538.GM1464@x96.org> <50450F2A.10708@FreeBSD.org>

next in thread | previous in thread | raw e-mail | index | archive | help
On Mon, Sep 03, 2012 at 01:12:26PM -0700, Doug Barton wrote:
> I didn't miss it. What postrandom does is delete all of the (by default)
> 8 files in /var/db/entropy that were the product of the previous boot's
> output. Then it re-generates /entropy, which was written out at the last
> shutdown, ideally after enough uptime for /dev/random to have been
> properly seeded, with a new file generated from a poorly seeded entropy
> pool as part of the boot process.

Yes, except /entropy is generated after /var/db/entropy/* and old
/entropy was fed in to yarrow. So I don't believe saying it's poorly
seeded at that point is fair.

On next reboot /entropy will get re-written anyway.

> IMO both of those are bad ideas, and lower both the quantity and quality
> of the entropy available at the next boot, should that happen prior to
> the (again, by default) 88 minutes it takes for the system to update
> /var/db/entropy.

I believe this is better than what we have today, since it prevents a
case where system crashes before cronjob (that writes to
saved-entropy.X) gets to run at all. This patch reduces this window to
matter of a second or so.

If you think quantity is very important here, (which I don't believe is
true) I am fine with not deleting /var/db/entropy/* on boot (It doesn't
make things better or worse).

> > In the end, assuming machine boots up passed postrandom script, we're left with
> > no stale seed files, but a freshly generated ${entropy_file_confirmed}, which
> > should be sufficient to seed next bootup.
 
> I understand how you're thinking about this, but unfortunately I'm quite
> certain your thinking is incorrect. As I pointed out in my last message,
> Yarrow is designed to cope with the possibility of replay attacks, and
> even with feeding in the same entropy files (after a short boot) the
> amount of new material we introduce at each boot fully alleviates this
> concern.

You could be correct about Yarrow, but the Bruce Schneier explicitly
recommends to recycle already used seed with a new one. Reference is
provided in the code.

Also, our findings have shown that on some very low end systems, these
seed files are pretty much the only source of entropy early during boot.
Moreover, we also uncovered other problems with the way things are
consumed by Yarrow via /dev/random.
We will provide more details on our findings a bit later.



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20120903203505.GN1464>