Remove haveged and ensure reads from /dev/urandom return good random numbers (refs: #17154)
haveged implements the HAVEGE algorithm to gather randomness from CPU timings. It runs as a service in the userspace and fills the entropy pool immediately when it is started and keeps filling it if the kernel’s entropy count falls low by reads from /dev/random. There are multiple issues with haveged: * The fact that it tries to use timing information from CPU instructions while running in userspace, thereby being subjected to the kernel’s scheduler, which could impact the randomness of the timings [1] * The CPU instruction it uses (RDTSC) returns predictable results in some virtualized environments [2] * No one seems to know whether haveged actually provides any good randomness. AFAIK, it was never thoroughly analyzed by experts. The haveged tests which are supposed evaluate the produced randomness also pass if haveged is fed with a constant input instead of the CPU timings [3]. [1] https://twitter.com/mjg59/status/1181426468519383041 [2] https://tls.mbed.org/tech-updates/security-advisories/polarssl-security-advisory-2011-02 [3] http://jakob.engbloms.se/archives/1374 Since Linux 5.6, using the getrandom system call and reading from /dev/random will not block (for long) anymore on x86 systems, because the kernel now has a built-in random number generator which uses CPU timings. This is superior to haveged because it is not subjected to the kernel's scheduler. So we now use that instead of haveged. To also ensure that reading from /dev/urandom returns good random numbers, we read 512 bytes from /dev/random during boot, which ensures that the entropy pool used by urandom is filled with at least 512 bytes of good entropy.
Loading
Please register or sign in to comment