Date: Wed, 19 Sep 2012 20:47:03 +0100 From: Ben Laurie <benl@freebsd.org> To: Jonathan Anderson <jonathan.anderson@cl.cam.ac.uk> Cc: freebsd-security@freebsd.org, Pawel Jakub Dawidek <pjd@freebsd.org> Subject: Re: Collecting entropy from device_attach() times. Message-ID: <CAG5KPzz=u-Wasvasg5PDOg0A8jLY7-iac=cDZuHvnsfRSLBZog@mail.gmail.com> In-Reply-To: <A8FD98DD94774D00B4E5F78D3174C1B4@gmail.com> References: <20120918211422.GA1400@garage.freebsd.pl> <A8FD98DD94774D00B4E5F78D3174C1B4@gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Wed, Sep 19, 2012 at 7:30 PM, Jonathan Anderson <jonathan.anderson@cl.cam.ac.uk> wrote: > On Tuesday, 18 September 2012 at 22:14, Pawel Jakub Dawidek wrote: >> [=85] we have more >> than 19 bits of entropy from this one call, but I reduced if to four >> bits only, because there are devices that are much faster to attach. >> > > Another reason for doing the above characterization is that, if a particu= lar device_attach() really does provide 12 bits of uncertainty, it's a sham= e to drop eight of them on the floor. Estimating at 4 bits does not drop any entropy on the floor, it just means that if you are going to unblock the PRNG once a certain amount of entropy is present, then this input counts for 4 bits against that certain amount. The amount of entropy harvested is unchanged. The reason to work out how much entropy there is is to: a) Unblock as early as possible b) Not unblock too early Erring on the side of underestimation is wise here.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?CAG5KPzz=u-Wasvasg5PDOg0A8jLY7-iac=cDZuHvnsfRSLBZog>