jpsollie Guru
Joined: 17 Aug 2013 Posts: 303
|
Posted: Mon Sep 23, 2024 11:13 am Post subject: entropy data sources in gentoo networks |
|
|
Hi everyone,
when digging through a lot of driver issues in hwrng device missing thread, I took a look at other possible sources of entropy.
So, I'd like your thoughts about it:
there are 2 entropy sources (nist and qrypt) which are networking related (but obviously nist is easily interceptable).
What if openrc would broadcast entropy in a non-routed multicast group?
The idea would be to use named pipes combined with UDP packets transferred at random through the network:
the code below illustrates what I was thinking about:
on entropy source 1:
Code: |
rngd -R 5 -i -n nist -n hwrng -n qrypt -O qrypt:tokenfile:qrypt.token &
while [ 1 ]; do read -n 512 err < /dev/random; echo "$err" | nc -w1 -ub 192.168.1.255 20000; sleep 5; done
|
... and off course when using broadcast / multicast groups you can initiate as many entropy devices as you want ...
and on the client:
Code: |
mkfifo /run/entropy.pipe
nohup nc -lk -u -b -p 20000 > /run/entropy.pipe &
rngd -f -R 5 -d -x jitter -x hwrng -x rdrand -n namedpipe -O namedpipe:path:/run/entropy.pipe -O namedpipe:timeout:10
Disabling 6: JITTER Entropy generator (jitter)
Disabling 0: Hardware RNG Device (hwrng)
Disabling 2: Intel RDRAND Instruction RNG (rdrand)
Enabling 10: Named pipe entropy input (namedpipe)
Initializing available sources
[namedpipe]: Initialized
Kernel entropy pool size 256, pool watermark 192
Reading entropy from Named pipe entropy input
Running FIPS test on entropy
entropy successfully gathered, preparing it for the kernel
Added 256/256 bits entropy
Pool full at 256, sleeping!
Added 256/256 bits entropy
Pool full at 256, sleeping!
Added 256/256 bits entropy
Pool full at 256, sleeping!
^C[namedpipe]: Shutting down
|
so, what do you guys think of this idea?
I know, it shouldn't be used as only source ... but it has some opportunities for iot devices not having a proper hwrng, right? _________________ The power of Gentoo optimization (not overclocked): [img]https://www.passmark.com/baselines/V10/images/503714802842.png[/img] |
|