RDRAND - entropy CONFIG_RANDOM_TRUST_CPU yes or no? / rng_core.default_quality

Yes…

Can be considered. But we need to understand more about how entropy is bootstrapped during the early boot process. Because entropy is a difficult subject. Even more so in virtual machines.

General good read about entropy:
https://www.av8n.com/computer/htm/secure-random.htm

Excellent writeup by systemd:
https://systemd.io/RANDOM_SEEDS.html

After reading above I concluded that flipping the wrong setting could worsen entropy, specifically in VMs.

https://wiki.debian.org/BoottimeEntropyStarvation

Can CONFIG_RANDOM_TRUST_CPU be similar be configured as a kernel parameter or sysctl?

I am asking, because until users machines will automatically re-compile their own kernel could be a long time, if ever, due to an unresolved blocker. See this very post kernel recompilation for better hardening starting from However, there is one blocker.

Is rng_core.default_quality related?

1 Like