Date: Fri, 6 Sep 2013 09:46:57 -0600 From: Warner Losh <imp@bsdimp.com> To: Mark R V Murray <mark@grondar.org> Cc: FreeBSD Security Team <secteam@freebsd.org>, FreeBSD-arch Arch <freebsd-arch@freebsd.org> Subject: Re: random(4) plugin infrastructure for mulitple RNG in a modular fashion Message-ID: <FE4A207E-9F5E-4782-8561-CF5BD08C3A8B@bsdimp.com> In-Reply-To: <0ABD5A7F-D647-4958-92DB-79D277C9AE7C@grondar.org> References: <20130816002625.GE76666@x96.org> <9B274F48-0C88-4117-BEAC-1A555772A3C5@grondar.org> <86a9kf733d.fsf@nine.des.no> <0C97B866-A169-4141-8368-AA7F5B5382F4@grondar.org> <861u5r71zi.fsf@nine.des.no> <892B11BD-396D-4F82-B97C-753F72CA494D@grondar.org> <86r4dr5j3p.fsf@nine.des.no> <4C1BD77C-8C6B-4044-9285-5978A3BC4B70@kientzle.com> <537622E1-F785-4BFA-B829-09DCDB484606@grondar.org> <932AB5CA-778E-438D-8FD3-8C0F29F3D117@kientzle.com> <20130823231808.GT94127@funkthat.com> <0ABD5A7F-D647-4958-92DB-79D277C9AE7C@grondar.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On Aug 24, 2013, at 2:35 AM, Mark R V Murray wrote: >=20 > On 24 Aug 2013, at 00:18, John-Mark Gurney <jmg@funkthat.com> wrote: >=20 >> Tim Kientzle wrote this message on Sun, Aug 18, 2013 at 12:27 -0700: >>> But clearly some people really want to be able to >>> force /dev/random to be the unconditioned output >>> of a particular HW RNG. I don't know if this is a >>> good idea or not, but clearly there are people who >>> want this. >>=20 >> Considering that the Ivy bridge's rdrand implementation already uses >> AES to condition the raw entropy source, using Yarrow/etc to >> additionally condition it seems excesive, hence why some people want >> to use it directly=85 >=20 > Nehemiah as well, using a Davies-meyer hash in software. However, what > may be excessive for one person may be another's requirement. Especially in light of the recent NSA revelations... I for one won't = trust hardware random number generation... I find it interesting that earlier in the thread there was a desire by a = certain router company to fulfill the NSA's requirement that it use the = random number stream from the intel chips directly, and that's what = kicked off this overly long thread. Warner
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?FE4A207E-9F5E-4782-8561-CF5BD08C3A8B>