use kernel command line as a source of randomness

[Patrick]

Kernel will use randomness from kernel command line anyhow. See links in initial post in this forum thread. [1]

This is similar to systemd-random-seed.service. Just happens earlier.

Disadvantages:

• does not work for first boot
• does not work for live boot but no worse than too due to [1]

Rationale: “use as many sources of entropy as possible in case any breaks down”.

See also: twuewand - a truerand algorithm for generating entropy - Whonix integration

@SokPuppette

That’s not actually a big problem with reasonably recent Linux on X86 processors, because the kernel will use the CPU’s RDSEED/RDRAND instructions to seed even /dev/urandom before returning any data to userspace. So unless your CPU has been subverted, or unless there’s a bug in what’s actually a pretty simple code path, you’ll never get bad randomness on X86. Really there’s only an issue on ARM.

We distrust (set random.trust_cpu=off kernel boot parameter) RDRAND. See:
Entropy, Randomness, /dev/random vs /dev/urandom, Entropy Sources, Entropy Gathering Daemons, RDRAND

I.e. it is used but not credited.

@SokPuppette

If you still care about the /dev/urandom early read problem, and you are willing to trust /dev/random, then you can always just create an early systemd unit to copy data from /dev/random into /dev/urandom.

We don’t have issues with boot speed / performance thanks to haveged / jitterentropy-rng (user space daemon and kernel module).