From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751146AbdAQRu4 (ORCPT ); Tue, 17 Jan 2017 12:50:56 -0500 Received: from imap.thunk.org ([74.207.234.97]:53898 "EHLO imap.thunk.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750933AbdAQRuy (ORCPT ); Tue, 17 Jan 2017 12:50:54 -0500 Date: Tue, 17 Jan 2017 12:15:39 -0500 From: "Theodore Ts'o" To: Denys Vlasenko Cc: Linux Kernel Mailing List , "H. Peter Anvin" , Denys Vlasenko Subject: Re: random: /dev/random often returns short reads Message-ID: <20170117171539.dadciiz2kfjtqrfk@thunk.org> Mail-Followup-To: Theodore Ts'o , Denys Vlasenko , Linux Kernel Mailing List , "H. Peter Anvin" , Denys Vlasenko References: <20170117043640.4ykofgcwfysvgyue@thunk.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: NeoMutt/20161126 (1.7.1) X-SA-Exim-Connect-IP: X-SA-Exim-Mail-From: tytso@thunk.org X-SA-Exim-Scanned: No (on imap.thunk.org); SAEximRunCond expanded to false Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, Jan 17, 2017 at 09:21:31AM +0100, Denys Vlasenko wrote: > > If someone wants to send me a patch, I'll happily take a look at it, > > Will something along these lines be accepted? The problem is that this won't work. In the cases that we're talking about, the entropy counter in the secondary pool is not zero, but close to zero, we'll still have short reads. And that's going to happen a fair amount of the time. Perhaps the best *hacky* solution would be to say, ok if the entropy count is less than some threshold, don't use the correct entropy calculation, but rather assume that all of the new bits won't land on top of existing entropy bits. It undoes some of Peter's very careful and accurate calculations (so I'd like Peter's thoughts), but in reality, very few people use /dev/random these days except for GPG and people hacking OpenSSL for FIPS certification so they can feed at at the US Federal Government's trough. I'm not sure I care *that* much, but then I think FIPS certification is a complete waste of Taxpayer dollars, so it's not something I care a whole lot about fixing, either. :-) - Ted