Adjust for ikiwiki → GitLab wiki authored by intrigeri's avatar intrigeri
[[!meta title="Seeding the random number generator"]]
[[!toc levels=2]]
---
title: Seeding the random number generator
---
[[_TOC_]]
# Introduction
......@@ -35,7 +40,7 @@ Qubes has tickets about this
# Current situation
See the related [[design document|contribute/design/random]]
See the related [design document](https://tails.boum.org/contribute/design/random)
Tails does not ship `/var/lib/urandom/random-seed` in the ISO, since it
means shipping a fixed known value for every Tails installation, which
......@@ -71,14 +76,14 @@ It is worth noting that the first time this Tails installation is
booted, most of the time the first step is to configure persistence,
which means creating an encrypted partition. At this step though, there
is probably very little entropy at this moment, which may weaken the
LUKS volume encryption ([[!tails_ticket 16891]]).
LUKS volume encryption (tails/tails#16891).
## Virtual Machines (ISO image as virtual DVD )
Tails supports booting virtual machines from ISO images.
Starting Tails from a DVD on bare metal is not supported anymore since
Tails 3.12 ([[!tails_ticket 15292]]).
Tails 3.12 (tails/tails#15292).
This may be the most difficult, since all that the user is running is the plain
ISO we provide. In there, there's no seed at all. It is of public
......@@ -107,7 +112,7 @@ on first boot, and then update it on every subsequent boot and clean
shutdown, similarly to an initial seed that Tails Installer would
write on the system partition.
This is WIP on [[!tails_ticket 11897]].
This is WIP on tails/tails#11897.
## Random value stored in an unused sector
......@@ -115,7 +120,7 @@ We can write a random value in an unused sector (e.g. LBA 34) on first
boot, and here again, update it on every subsequent boot and
clean shutdown.
This is WIP on [[!tails_ticket 11897]].
This is WIP on tails/tails#11897.
## Use the Tails Installer to create a better seed
......@@ -136,13 +141,13 @@ it read-only and unmounting it. Obviously we can do this only in
normal shutdown process, and we'll have to avoid it in emergency
shutdown mode.
This is WIP on [[!tails_ticket 11897]].
This is WIP on tails/tails#11897.
We may alternatively not update it, and use it only when the persistence is not
enabled. That would still be a unique source of entropy per Tails installation,
so that would be a better situation than the current one.
## Use stronger/more entropy collectors [[!tails_ticket 5650]]
## Use stronger/more entropy collectors tails/tails#5650
As already stated, Tails runs Haveged and rngd.
......@@ -181,8 +186,7 @@ XXX: will enough entropy be gathered on such a blocked, idling system?
XXX: So before going on, we need a bit more data about the state of the entropy when
Tails boots, especially now that we have several entropy collector daemons. It may
very well be that this case does not happen anymore. And if it does, we need to know
on average how much time that blocking would last. [[!tails_ticket
11758]]
on average how much time that blocking would last. tails/tails#11758
## Regularly check available entropy and notify if low
......@@ -199,7 +203,7 @@ entropy available?
# Abandoned solutions
## Persist entropy pool seeds [[!tails_ticket 7675]]
## Persist entropy pool seeds tails/tails#7675
For users who enable the persistent storage option, we could store
there a seed from the previous session to help bootstrap with some
......@@ -211,13 +215,12 @@ the first time Tails is booted, which is likely when the encrypted persistence
partition is created.
And meanwhile, we have found ways to get the same benefits for every
Tails USB stick, with or without persistence (WIP on [[!tails_ticket
11897]]).
Tails USB stick, with or without persistence (WIP on tails/tails#11897).
# Related tickets
This is about [[!tails_ticket 7642]], [[!tails_ticket 7675]],
[[!tails_ticket 6116]], [[!tails_ticket 11897]] and friends.
This is about tails/tails#7642, tails/tails#7675,
tails/tails#6116, tails/tails#11897 and friends.
# Also see
......@@ -228,3 +231,4 @@ This is about [[!tails_ticket 7642]], [[!tails_ticket 7675]],
* <https://eprint.iacr.org/2013/338.pdf>
* <https://www.python.org/dev/peps/pep-0506/>
* <https://docs.python.org/2/library/os.html#os.urandom>