From owner-freebsd-security@FreeBSD.ORG Wed Sep 19 19:59:16 2012 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 628D7106566B; Wed, 19 Sep 2012 19:59:16 +0000 (UTC) (envelope-from benlaurie@gmail.com) Received: from mail-vc0-f182.google.com (mail-vc0-f182.google.com [209.85.220.182]) by mx1.freebsd.org (Postfix) with ESMTP id 06B358FC1B; Wed, 19 Sep 2012 19:59:15 +0000 (UTC) Received: by vcbfw7 with SMTP id fw7so2156270vcb.13 for ; Wed, 19 Sep 2012 12:59:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:sender:in-reply-to:references:date :x-google-sender-auth:message-id:subject:from:to:cc:content-type :content-transfer-encoding; bh=rMqRM4ZM/bTnxx+Ltzy6rfD0q3NUlc7ME5CCXTB75lE=; b=1DE8G7yMQUrnhXXB9PJswyXw4HjM3LolDQ1pkM1XBa3QdtTtlKbv8bQw+0GM5uEdMz 65WnkTTV0c7za36qL0wqrnNr41wnCTduwCofqN0luZow1aEQgEs+LyaLl192EM8FQYH8 pb8Uq8Yz7c/Hv6vCMWMrp7eWcWL7w4Eqggb1ZTEc6ievNzjM9FJ5RqPZruzmQolADS38 QAsrEY6Iz+h4CExzcJD5n4mlTJ7BwMEDSi9b6THyFnoPmrFVb8ufLshJqJdBi11EVMW5 k1CoacPXSpaiu4fYO9TBy4TBDa1I7FzZ4uSuP/l/lsurOAhtOxSUei5nv926n9PFre00 olvA== MIME-Version: 1.0 Received: by 10.220.157.65 with SMTP id a1mr2500130vcx.39.1348084755138; Wed, 19 Sep 2012 12:59:15 -0700 (PDT) Sender: benlaurie@gmail.com Received: by 10.58.79.243 with HTTP; Wed, 19 Sep 2012 12:59:15 -0700 (PDT) In-Reply-To: <20120919192923.GA1416@garage.freebsd.pl> References: <20120918211422.GA1400@garage.freebsd.pl> <20120919192923.GA1416@garage.freebsd.pl> Date: Wed, 19 Sep 2012 20:59:15 +0100 X-Google-Sender-Auth: eGQo4c0ek-MowtatjG8WAmEoB9I Message-ID: From: Ben Laurie To: Pawel Jakub Dawidek Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: quoted-printable Cc: freebsd-security@freebsd.org, Jonathan Anderson Subject: Re: Collecting entropy from device_attach() times. X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 19 Sep 2012 19:59:16 -0000 On Wed, Sep 19, 2012 at 8:29 PM, Pawel Jakub Dawidek wrot= e: > On Wed, Sep 19, 2012 at 07:30:52PM +0100, Jonathan Anderson wrote: >> > If all the times are more or less equally probable in this range [=85] >> >> They're very unlikely to be equally probable. It would make sense to do = some characterization of these times and their statistics: a highly non-uni= form distribution would mean that we don't actually get many bits per attac= h. > > I have times for ~2000 device_attach() calls when loading sound card > driver on totally idle system. If someone could take those and analyse > the distribution that would be great. > >> > [=85] we have more >> > than 19 bits of entropy from this one call, but I reduced if to four >> > bits only, because there are devices that are much faster to attach. >> > >> >> Another reason for doing the above characterization is that, if a partic= ular device_attach() really does provide 12 bits of uncertainty, it's a sha= me to drop eight of them on the floor. > > Rights. That's why I've prepared another patch: > > http://people.freebsd.org/~pjd/patches/harvest_device_attach.2.pa= tch > > which effectively discards top ten bits, which means we expect 0.1% of > the attach time to be unpredictable (the attach time in most cases vary > by few percent, not sure yet how much of this variation is really > unpredictable). This is the wrong thing to do! There's no reason to discard bits on input (modulo the device throwing away inputs, that is) - just reduce your entropy estimate. "Extra" bits do no harm.