| 1 |
Roger Light <rogerlight@×××××.com> 2010-03-09 09:09: |
| 2 |
> (I sent this with my non-list address first by mistake, so apologies |
| 3 |
> if it comes through twice). |
| 4 |
> |
| 5 |
> On Mon, Mar 8, 2010 at 8:48 AM, Ed W <lists@××××××××××.com> wrote: |
| 6 |
> |
| 7 |
> > I guess some patch to use network packets to seed the pool with randomness |
| 8 |
> > would also be useful, btu that's way beyond what I'm going to offer a patch |
| 9 |
> > for in the near future... |
| 10 |
> |
| 11 |
> About two years ago I emailed the maintainer of the via_rhine network |
| 12 |
> driver, Roger Luethi, asking whether adding IRQF_SAMPLE_RANDOM to the |
| 13 |
> flags in its call to request_irq() would be appropriate or not. His |
| 14 |
> reply included: |
| 15 |
> |
| 16 |
> "If you check the other network drivers, most don't do that. IIRC the |
| 17 |
> argument was that interrupts in network drivers can to some extent be |
| 18 |
> controlled from the outside, so they should not be used as a source for |
| 19 |
> randomness." |
| 20 |
> |
| 21 |
> If you want to try it, it's an extremely simple change to your network |
| 22 |
> driver, along the lines of: |
| 23 |
> |
| 24 |
> - rc = request_irq(rp->pdev->irq, &rhine_interrupt, |
| 25 |
> IRQF_SHARED, dev->name, |
| 26 |
> + rc = request_irq(rp->pdev->irq, &rhine_interrupt, IRQF_SHARED |
| 27 |
> | IRQF_SAMPLE_RANDOM, dev->name, |
| 28 |
> |
| 29 |
> He also suggested bringing it up on the lkml if I wanted, after |
| 30 |
> checking the archives. I did neither, but it's there as an option for |
| 31 |
> you. |
| 32 |
> |
| 33 |
> Cheers, |
| 34 |
> |
| 35 |
> Roger |
| 36 |
|
| 37 |
I read a couple of interesting threads regarding some arguments for and |
| 38 |
against that yesterday. |
| 39 |
|
| 40 |
My basic reading is that |
| 41 |
|
| 42 |
- IRF_SAMPLE_RANDOM is due to be replaced by some other interface that's |
| 43 |
common to all input devices. |
| 44 |
|
| 45 |
- There's a general feeling that gathering entropy from a network device |
| 46 |
can be remotely influenced and is therefore probably not ideal. In |
| 47 |
theory entropy can be obtained fairly well from other sources, like |
| 48 |
the various egds mentioned already on this thread, or just by doing |
| 49 |
hashes over some other special devices that that kernel already |
| 50 |
provides. |
| 51 |
|
| 52 |
Here's some links: |
| 53 |
http://lkml.indiana.edu/hypermail/linux/kernel/0805.1/2091.html |
| 54 |
http://linux.derkeiler.com/Mailing-Lists/Kernel/2006-05/msg01294.html |
| 55 |
http://thread.gmane.org/gmane.linux.kernel/680723 |
| 56 |
http://kerneltrap.org/mailarchive/linux-netdev/2009/4/6/5419494 |
| 57 |
|
| 58 |
Cheers, |
| 59 |
Brian |
Archives