better TRNG support

[phabricator-migrator]

Information

ID: 208
PHID: PHID-TASK-zhx6bgdyihlhkdga4vhe
Author: Patrick
Status at Migration Time: wontfix
Priority at Migration Time: Normal

Description

TODO:

• Consider installing more TRNG supporting packages by default in Whonix. (Non-exhaustive list)
• Suggest to upstream, to Debian’s installer to install havegend and/or TRNG supporting packages by default for better security.

Good discussion on entropy mixing of rngd and haveged, which may not be that simple:
https://labs.riseup.net/code/issues/5650#note-16
(Asked David if he could please follow up on that ticket.)

Comments

---

HulaHoop

2015-07-25 21:06:34 UTC

The common wisdom is “more entropy can’t hurt” but given the almost certain probability of Intel hardware RNG being subverted [1] and the doubts about this common idea by cryptologist Daniel Bernstein [2] I thing we should throw out the idea of supporting TRNG and add only on fully open and trusted RNG packages that are authored by knowledgeable people. A malicious vs broken rng is actually harmful.

[1]Surreptitiously Tampering with Computer Chips - Schneier on Security
[2]cr.yp.to: 2014.02.05: Entropy Attacks!

---

Patrick

2015-07-26 06:36:37 UTC

This isn’t tied to Intel. There are other vendors.

---

HulaHoop

2015-07-26 17:33:02 UTC

Right. Same applies to any closed hardware implementation not open to public review.

---

Patrick

2015-07-27 11:18:47 UTC

What about Open Hardware implementations? Such as onerng?

---

HulaHoop

2015-07-27 13:06:56 UTC

Open Hardware implementations are great to have. Does onerng use a different pakage?

---

Patrick

2015-07-27 13:24:12 UTC

As per OneRNG - Hardware Random Number Generator instructions, it also uses rng-tools. (+ The onerng driver package.) (Note: this ticket is not necessarily limited to rngd either.)

---

Patrick

2015-07-27 13:33:18 UTC

Back to the proprietary hardware issue.

but given the almost certain probability of Intel hardware RNG being subverted [1]

If you find this likely… I also wouldn’t be surprised by such a backdoor… Haven’t we reached the seemingly non-solveable trustworthy hardware problem? If you find it likely, that Intel has a backdoor, you probably also find it likely, that AMD has a backdoor. What about CPU backdoors then? Is it consistent to recommend avoiding Intel RNG while not recommending to avoid Intel CPU’s?

---

HulaHoop

2015-07-27 14:18:04 UTC

Subverting the HWRNG is the lower hanging fruit and is the most effective to target. It needs minimal conspiracy as only a very simple and small modification is done to sabotage it during the manufacturing process so no one in the design process even knows about it. Its the ultimate backdoor because without a good RNG everything else falls apart.

Before the Snowden revelations and this paper on RNG backdooring there was intense pressure on Ted Tso (kernel RNG developer) by Intel to make Linux rely exclusively on their HWRNG. Fortunately he did not cave in and it was limited to one of the entropy sources not the only one.

---

I’m looking if rngd can be configured to use only specific entropy generating hardware devices (to use the trusted one only) but it doesn’t seem possible at this level. It may be an option only at the hw_random kernel module.

Linux Manpages Online - man.cx manual pages

WARNING

Depending on its settings, rngd can dominate the kernel’s entropy pool, by feeding it so much data, so often, that other sources of entropy are mostly ignored or lost. Do not to that unless you trust rngd’s source of random data ultimately.

Also, there is only so much bandwidth available from a TRNG, and it is often not much. Don’t drain too much with too low a feed-interval, or rngd may not have enough data on its buffers when the kernel gets low on entropy.

---

Patrick

2015-07-28 16:06:36 UTC

! In T208#6040, @HulaHoop wrote:
The common wisdom is “more entropy can’t hurt” […]
the doubts about this common idea by cryptologist Daniel Bernstein [2] I think we should throw out the idea of supporting TRNG […]
[2]cr.yp.to: 2014.02.05: Entropy Attacks!

Discussion:
Redirecting to Google Groups

Daniel Bernstein makes a good argument. I guess we can close this as wontfix then?

---

HulaHoop

2015-07-28 18:12:45 UTC

Yes.