Wgetting bytes from random.org

Posted May 24, 2008 2:12 UTC (Sat) by jch (guest, #51929)
In reply to: Wgetting bytes from random.org by pr1268
Parent article: Appropriate sources of entropy

> But isn't that what's happening all the time anyway, with the "environmental noise from
device drivers and other sources"

No.  The various sources of entropy add entropy to the random pool and increase the entropy
estimate by some small value.

You may want to see for yourself in the kernel sources -- they end up calling
add_timer_randomness (drivers/char/random.c line 571) which calls add_entropy_words and then
credit_entropy_store.  This increases the value of entropy_count, and may cause processes
blocking on /dev/random to wake up.

to post comments

Wgetting bytes from random.org

Posted May 24, 2008 3:52 UTC (Sat) by pr1268 (guest, #24648) [Link] (3 responses)

So how is me writing bytes to /dev/random via a script any different than what my distro (Slackware 12.0) does in rc.S (also a script) when the "carry-over" entropy file (/etc/random-seed) is written to the random device? Other than a difference in quantity of bytes, I see no difference.

My intuition was that /dev/random is (root) writable so that the sysadmin can incorporate additional sources of entropy. I don't mean to sound like I'm arguing, just sincerely interested... Thanks!

Wgetting bytes from random.org

Posted May 24, 2008 5:53 UTC (Sat) by dlang (guest, #313) [Link]

the sysadmin can add randomness, but the system will not trust that it is random (without
tweaking things via the ioctl), even if the sysadmin sends completely predictable data to
/dev/random it won't do any harm.

Wgetting bytes from random.org

Posted May 24, 2008 16:26 UTC (Sat) by jch (guest, #51929) [Link] (1 responses)

> My intuition was that /dev/random is (root) writable so that the sysadmin can incorporate
additional sources of entropy.

The distinction between mixing in new data into the random pool and adding to the entropy
estimate is what the article is about.

The in-kernel RNG maintains a pool of random data and an estimate of how much entropy is in
the pool.

When you read from /dev/(u)random, the entropy estimate is reduced.  When it reaches 0, reads
from /dev/random will block.  That's the easy part.

The difficult part is deciding when to increase the entropy estimate.  When you write 100
bytes to /dev/random, unless the 100 bytes are perfectly random, they should not add 800 bits
to the entropy estimate, but some lower value that only the person who generated the data is
able to choose reasonably.

For that reason, merely writing to /dev/random does not add to the entropy estimate; you need
to explicitly increase it by using the ioctl.

> So how is me writing bytes to /dev/random via a script any different than what my distro
(Slackware 12.0) does in rc.S (also a script) when the "carry-over" entropy file
(/etc/random-seed) is written to the random device?

It's no different.  Your distribution is mixing the old data into the random pool, but not
increasing the entropy estimate.  This way if the carry-over data is not truly random, no
serious security vulnerability will ensue.

Thanks for the replies

Posted May 26, 2008 2:23 UTC (Mon) by pr1268 (guest, #24648) [Link]

Thanks to those who replied to my questions. Coincidentally, Ted T'so recently had a related explanation (to dlang's and jch's above) on the LKML.