From owner-freebsd-security@FreeBSD.ORG Sun Sep 16 16:30:23 2012 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id 393A91065670 for ; Sun, 16 Sep 2012 16:30:23 +0000 (UTC) (envelope-from markm@FreeBSD.org) Received: from gromit.grondar.org (grandfather.grondar.org [93.89.92.32]) by mx1.freebsd.org (Postfix) with ESMTP id D93178FC08 for ; Sun, 16 Sep 2012 16:30:22 +0000 (UTC) Received: from uucp by gromit.grondar.org with local-rmail (Exim 4.77 (FreeBSD)) (envelope-from ) id 1TDHed-00084Z-Vm for freebsd-security@freebsd.org; Sun, 16 Sep 2012 17:25:07 +0100 Received: from localhost ([127.0.0.1] helo=groundzero.grondar.org) by groundzero.grondar.org with esmtp (Exim 4.77 (FreeBSD)) (envelope-from ) id 1TDHb0-000FIh-0Z; Sun, 16 Sep 2012 17:21:22 +0100 To: Ben Laurie , Arthur Mesh , Ian Lepore , Doug Barton , "David O'Brien" , freebsd-security@freebsd.org, RW In-reply-to: References: <50453686.9090100@FreeBSD.org> <20120911082309.GD72584@dragon.NUXI.org> <504F0687.7020309@FreeBSD.org> <201209121628.18088.jhb@freebsd.org> <5050F477.8060409@FreeBSD.org> <20120912213141.GI14077@x96.org> <20120913052431.GA15052@dragon.NUXI.org> From: Mark Murray MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="----- =_aaaaaaaaaa0" Content-ID: <58816.1347812437.0@groundzero.grondar.org> Date: Sun, 16 Sep 2012 17:21:21 +0100 Message-Id: Cc: Subject: Proposed fix; stage 1 (Was: svn commit: r239569 - head/etc/rc.d) X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 16 Sep 2012 16:30:23 -0000 ------- =_aaaaaaaaaa0 Content-Type: text/plain; charset="us-ascii" Content-ID: <58816.1347812437.1@groundzero.grondar.org> Hi Part 1 of the fix is enclosed; it involves drastically shortening the input into /dev/random (the "kickstart") at boot time. There are time implications that I'd like to hear any objections to. Part 1a is going to be tweeks to stashing entropy at restart (and possibly during normal running). Also fixes to zero-entropy first-startup. Part 2 will be a cheap shortening of files during reading so as not to clog up the harvest queue. The harvest queue will always be a bit intolerant of excess input via this route, so this should help a lot. Part 3 will be the addition of another choice of software PRNG; Fortuna. Fortuna is MUCH more resilient to attack, at the expense of using more kernel memory. For modern machines, this is scarcely noticeable, but it could be bad for embedded units. Tweeks along the way may include reverting to the original intent of starting the PRNG blocked, and only unblocking once reseeded. M -- Mark R V Murray Pi: 132511160 ------- =_aaaaaaaaaa0 Content-Type: text/plain; file="initrandom.diff"; charset="us-ascii" Content-ID: <58816.1347812437.2@groundzero.grondar.org> Content-Description: initrandom.diff Index: initrandom =================================================================== --- initrandom (revision 240384) +++ initrandom (working copy) @@ -23,15 +23,12 @@ better_than_nothing() { - # XXX temporary until we can improve the entropy - # harvesting rate. # Entropy below is not great, but better than nothing. # This unblocks the generator at startup # Note: commands are ordered to cause the most variance across reboots. - ( kenv; dmesg; df -ib; ps -fauxww; date; sysctl -a ) \ - | dd of=/dev/random bs=8k 2>/dev/null - /sbin/sha256 -q `sysctl -n kern.bootfile` \ - | dd of=/dev/random bs=8k 2>/dev/null + for cmd in "kenv" "dmesg" "df -ib" "ps -fauxww" "date" "sysctl -ao" "netstat -arn" "fstat" ; do + ${cmd}| sha256 > /dev/random + done } initrandom_start() @@ -67,6 +64,12 @@ # First pass at reseeding /dev/random. # + better_than_nothing + + sleep 1 + + # Give the RNG the best kicking that we might not have. + # case ${entropy_file} in [Nn][Oo] | '') ;; @@ -77,8 +80,6 @@ ;; esac - better_than_nothing - echo -n ' kickstart' fi ------- =_aaaaaaaaaa0--