Am Donnerstag, 26. Dezember 2019, 12:12:29 CET schrieb Andy Lutomirski:

Hi Andy,

quoted

On Dec 26, 2019, at 5:29 PM, Stephan Müller [off-list ref] wrote:

Am Montag, 23. Dezember 2019, 09:20:43 CET schrieb Andy Lutomirski:

Hi Andy,

quoted

There are some open questions and future work here:

Should the kernel provide an interface to get software-generated
"true random" numbers?  I can think of only one legitimate reason to
use such an interface: compliance with government standards.  If the
kernel provides such an interface going forward, I think it should
be a brand new character device, and it should have a default mode
0440 or similar.  Software-generated "true random numbers" are a
very limited resource, and resource exhaustion is a big deal.  Ask
anyone who has twiddled their thumbs while waiting for gnupg to
generate a key.  If we think the kernel might do such a thing, then
patches 5-8 could be tabled for now.

What about offering a compile-time option to enable or disable such code?
Note, with the existing random.c code base, there is no need to have a
separate blocking_pool. The ChaCha20 DRNG could be used for that very same
purpose, provided that in case these true random numbers are generated
when
the Chacha20 DRNG received an equal amount of "unused" entropy.

This scares me. The DRNG should be simple and easy to understand. If we’re
tapping extra numbers in some weird way, then I would be more comfortable
with some clear assurance that this doesn’t break the security. If we’re
tapping numbers in the same way as normal urandom, then I don’t really see
the point.

Agreed. I was just trying to outline that the removal of the blocking_pool is 
a good thing. Even when we decide that random.c should receive a TRNG, we do 
not need to re-add a blocking pool, but can easily use the existing ChaCha20 
DRNG (most likely with its own instance).

quoted

quoted

Alternatively, perhaps the kernel should instead provide a
privileged interface to read out raw samples from the various
entropy sources, and users who care could have a user daemon that
does something intelligent with them.  This would push the mess of
trying to comply with whatever standards are involved to userspace.
Userspace could then export "true randomness" via CUSE if it is so
inclined, or could have a socket with a well-known name, or whatever
else seems appropriate.

With the patch set v26 of my LRNG I offer another possible alternative
avoiding any additional character device file and preventing the
starvation of legitimate use cases: the LRNG has an entropy pool that
leaves different levels of entropy in the pool depending on the use cases
of this data.

If an unprivileged caller requests true random data, at least 1024 bits of
entropy is left in the pool. I.e. all entropy above that point is
available
for this request type. Note, even namespaces fall into this category
considering that unprivileged users can create a user name space in which
they can become root.

This doesn’t solve the problem. If two different users run stupid programs
like gnupg, they will starve each other.

But such scenario will always occur, will it not? If there are two callers for 
a limited resource, they will content if one "over-uses" the resource. My idea 
was to provide an interface where its use does not starve other more relevant 
use cases (e.g. seeding of the DRNGs). I.e. a user of a TRNG has the right to 
be DoSed - that is the price to pay when using this concept.

As I see it, there are two major problems with /dev/random right now: it’s
prone to DoS (i.e. starvation, malicious or otherwise), and, because no
privilege is required, it’s prone to misuse. Gnupg is misuse, full stop. If
we add a new unprivileged interface, gnupg and similar programs will use
it, and we lose all over again.

I am under the impression that the over-using of /dev/random is that other use 
cases like re-seeding of /dev/urandom are DoSed. But if there is a hog on the 
TRNG that only causes a problem for itself for other equally specialized 
applications, so be it.

When using a char device with rights of 440, then at least all applications 
part of that special group will still content for TRNG data. The only 
additional benefit I would currently see for a char device with permissions of 
440 is that an admin can control which applications have access to the TRNG to 
begin with. But when an attacker can fool those applications to use more 
random data, we again have a DoS. So, we just pushed the issue down the road 
without solving it (and I think there is no solution for the issue that TRNG 
users can DoS each other). 

Speaking of GnuPG and after having some discussions with Werner Koch, I think 
the reason for using /dev/random was that this (used to be) the only 
randomness source that has a guarantee of being seeded (Werner is not 
participating in this thread, so I hope I am not misrepresenting his words). 
With the presence of getrandom(2), this is now solved. IIRC libgcrypt has 
received support for getrandom(2) and the issue of blocking on /dev/random 
should now be a thing of the past with recent libgcrypt (and thus GnuPG) 
versions. 

Ciao
Stephan