Skip to content
Commit d0739b27 authored by segfault's avatar segfault
Browse files

Remove haveged and ensure reads from /dev/urandom return good random numbers (refs: #17154)

haveged implements the HAVEGE algorithm to gather randomness from
CPU timings. It runs as a service in the userspace and fills the entropy
pool immediately when it is started and keeps filling it if the kernel’s
entropy count falls low by reads from /dev/random.

There are multiple issues with haveged:

* The fact that it tries to use timing information from CPU
  instructions while running in userspace, thereby being subjected to
  the kernel’s scheduler, which could impact the randomness of the
  timings [1]

* The CPU instruction it uses (RDTSC) returns predictable results in
  some virtualized environments [2]

* No one seems to know whether haveged actually provides any good
  randomness. AFAIK, it was never thoroughly analyzed by experts. The
  haveged tests which are supposed evaluate the produced randomness
  also pass if haveged is fed with a constant input instead of the CPU
  timings [3].

[1] https://twitter.com/mjg59/status/1181426468519383041
[2] https://tls.mbed.org/tech-updates/security-advisories/polarssl-security-advisory-2011-02
[3] http://jakob.engbloms.se/archives/1374

Since Linux 5.6, using the getrandom system call and reading from
/dev/random will not block (for long) anymore on x86 systems, because
the kernel now has a built-in random number generator which uses CPU
timings. This is superior to haveged because it is not subjected to the
kernel's scheduler. So we now use that instead of haveged.

To also ensure that reading from /dev/urandom returns good random
numbers, we read 512 bytes from /dev/random during boot, which ensures
that the entropy pool used by urandom is filled with at least 512 bytes
of good entropy.
parent d55905c6
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment