Date: Wed, 19 Sep 2012 21:29:24 +0200 From: Pawel Jakub Dawidek <pjd@FreeBSD.org> To: Jonathan Anderson <jonathan.anderson@cl.cam.ac.uk> Cc: freebsd-security@freebsd.org Subject: Re: Collecting entropy from device_attach() times. Message-ID: <20120919192923.GA1416@garage.freebsd.pl> In-Reply-To: <A8FD98DD94774D00B4E5F78D3174C1B4@gmail.com> References: <20120918211422.GA1400@garage.freebsd.pl> <A8FD98DD94774D00B4E5F78D3174C1B4@gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
--tKW2IUtsqtDRztdT Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Wed, Sep 19, 2012 at 07:30:52PM +0100, Jonathan Anderson wrote: > > If all the times are more or less equally probable in this range [=E2= =80=A6] >=20 > They're very unlikely to be equally probable. It would make sense to do s= ome characterization of these times and their statistics: a highly non-unif= orm distribution would mean that we don't actually get many bits per attach. I have times for ~2000 device_attach() calls when loading sound card driver on totally idle system. If someone could take those and analyse the distribution that would be great. > > [=E2=80=A6] we have more > > than 19 bits of entropy from this one call, but I reduced if to four > > bits only, because there are devices that are much faster to attach. > > =20 >=20 > Another reason for doing the above characterization is that, if a particu= lar device_attach() really does provide 12 bits of uncertainty, it's a sham= e to drop eight of them on the floor. Rights. That's why I've prepared another patch: http://people.freebsd.org/~pjd/patches/harvest_device_attach.2.patch which effectively discards top ten bits, which means we expect 0.1% of the attach time to be unpredictable (the attach time in most cases vary by few percent, not sure yet how much of this variation is really unpredictable). --=20 Pawel Jakub Dawidek http://www.wheelsystems.com FreeBSD committer http://www.FreeBSD.org Am I Evil? Yes, I Am! http://tupytaj.pl --tKW2IUtsqtDRztdT Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.19 (FreeBSD) iEYEARECAAYFAlBaHRMACgkQForvXbEpPzRAagCgnUwOkUfhneiduAdo2aqFnAln 26IAn0clPnWYXZAlFaNixCgD2kdUPF1H =rhV9 -----END PGP SIGNATURE----- --tKW2IUtsqtDRztdT--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20120919192923.GA1416>