On Sun, Sep 16, 2012 at 05:21:21PM +0100, Mark Murray wrote: > Part 1 of the fix is enclosed; it involves drastically shortening the > input into /dev/random (the "kickstart") at boot time. There are time > implications that I'd like to hear any objections to. .... > better_than_nothing() > { > - # XXX temporary until we can improve the entropy > - # harvesting rate. > # Entropy below is not great, but better than nothing. > # This unblocks the generator at startup > # Note: commands are ordered to cause the most variance across reboots. > - ( kenv; dmesg; df -ib; ps -fauxww; date; sysctl -a ) \ > - | dd of=/dev/random bs=8k 2>/dev/null > - /sbin/sha256 -q `sysctl -n kern.bootfile` \ > - | dd of=/dev/random bs=8k 2>/dev/null > + for cmd in "kenv" "dmesg" "df -ib" "ps -fauxww" "date" "sysctl -ao" "netstat -arn" "fstat" ; do > + ${cmd}| sha256 > /dev/random > + done Hi Mark, A few days ago I posted a patch that changed the 'ps' and 'sysctl' commands based on good input from several folks in this on-going discussion. If your patch is to discuss a framework for "chunking", ignore the rest of this email. If not, and this patch is ready-for-commit I feel parts of my patch should be part of this one. That being sysctl and ps command changes, along with added documentation. Also, you have some commands in your list that are in /usr. As such I do not think they are usable in 'initrandom'. Or do is there sufficient support to commit my patch as-is now as a basis for yours and others suggested changes? better_than_nothing() { - # XXX temporary until we can improve the entropy - # harvesting rate. # Entropy below is not great, but better than nothing. - # This unblocks the generator at startup - # Note: commands are ordered to cause the most variance across reboots. - ( kenv; dmesg; df -ib; ps -fauxww; date; sysctl -a ) \ - | dd of=/dev/random bs=8k 2>/dev/null + + # Entropy below is not great, but better than nothing. + # Overwhelming the internal entropy seeding buffers is a NOP. + # Once the internal buffers are filled, additional input is + # dropped on the floor until the buffers are processed. + # For FreeBSD's current yarrow implementation that means + # there is little need to seed with more than 4k of input. + # In order to reduce the size of the seed input we hash it. + + # The output of a cryptographic hash function whose input + # contained 'n' bits of entropy will have 'm' bits of entropy, + # where 'm' is either 'n' or slightly less due to collisions. + # So we operate under the premise that there is essentially + # no loss of entropy in hashing these inputs. + /sbin/sha256 -q `sysctl -n kern.bootfile` \ | dd of=/dev/random bs=8k 2>/dev/null + + # Note: commands are ordered based on least changing across reboots + # to most: + ( dmesg; kenv; df -ib; \ + ps -fauxrH -o majflt,minflt,nivcsw,nvcsw,nwchan,re,sl,time; \ + sysctl -n kern.cp_times kern.geom kern.lastpid kern.timecounter \ + kern.tty_nout kern.tty_nin vm vfs debug dev.cpu; \ + date ) \ + | /sbin/sha256 -q | dd of=/dev/random bs=8k 2>/dev/null } -- -- David ([email protected]) _______________________________________________ [email protected] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-security To unsubscribe, send any mail to "[email protected]"