<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div class=""><div class=""><i class="">Topic: The OpenSSL 3.0.0 release will include mitigation for the low entropy on boot and first boot problems.</i></div><div class=""><i class="">Comment: PR#9084 removed such mitigation due to the negative side effects.</i></div></div><div class=""><i class=""><br class=""></i></div>This vote has passed (two for, four abstain, none against):<div class=""><br class=""></div><div class=""><div class=""><br class=""></div><div class="">The discussion now needs to turn to how this can be done.</div><div class=""><br class=""></div><div class="">The mitigation is for older Linux kernels only (and perhaps old Unix machines of other flavours). So no Windows, getentropy(3), ….</div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">I have a suggestion. Two kind of.</div><div class=""><br class=""></div><div class="">Use a volatile mechanism for communicating between processes — a file in /tmp, a block of shared memory or whatever.</div><div class="">On system boot, the first instance of libcrypto that attempts to read /dev/urandom, first locks the shared resource and reads one byte from /dev/random. It uses the shared resource to indicate that the read was successful and continues seeding from /dev/urandom.</div><div class="">Other instances of libcrypto start up, see that the shared resource is properly initialised and go straight to using /dev/urandom.</div><div class="">On system shutdown/reboot, the communication mechanism disappears and the entire process will repeat on the next boot.</div><div class="">There are some fine details but this is the gist of it.</div><div class=""><br class=""></div><div class=""><div class="">This is more difficult to describe than code: see <a href="https://github.com/openssl/openssl/pull/9152" class="">#9152</a>.</div></div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">Notes:</div><div class=""><br class=""></div><div class="">1. Reading the byte from /dev/random avoid problems on systems that cannot select(2) on /dev/random.</div><div class=""><br class=""></div><div class="">2. Early start up of /libcrypto will block until entropy is available (and consume eight bits of same). Later starts have the overhead of the locking and resource access. Importantly, no entropy will be drained from the system pool after start up.</div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><div class="">The second suggestion is broadly similar but requires a file containing entropy that persists across reboots. This alternative requires a more management: the entropy file once read needs to be rewritten immediately (and ideally on shutdown as well). It also introduces a new attack vector against the entropy storage. It also isn’t possible to skip the entropy file read/rewrite sequence because it is impossible to determine if /dev/urandom has actually been seeded. I’ve not attempted to code this, persistent files containing seed material potentially introduce other problems.</div></div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">Pauli</div><div class="">
<div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none;">-- <br class="">Dr Paul Dale | Cryptographer | Network Security & Encryption <br class="">Phone +61 7 3031 7217<br class="">Oracle Australia</div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none;"><br class=""></div><br class="Apple-interchange-newline">
</div>
<br class=""></div></div></body></html>