Page MenuHomePhabricator

install jitterentropy by default
Closed, ResolvedPublic

Description

Summary: jitterentropy is a RNG designed in the spirit of haveged (using CPU timer jitter as entropy source) except it made up of a kernel module - mainlined since Linux 4.2 and a userspace daemon (jitterentropy-rngd*) to prevent /dev/random from blocking. The advantage of jitterentropy is by taking advantage of a loaded kernel module, it can ensure randomness is being collected before the CSPRNG is initialized. So, when CSPRNG initialization happens, we can ensure that it is properly seeded on first boot, minimizing the likelihood that exact keys will be created on distinct systems. This is something haveged can't provide, as it runs entirely in userspace.

*jitterentropy-rngd is now included in Debian sid so we should look out for its eventual inclusion in stable next.

http://www.chronox.de/jent.html
http://www.chronox.de/jent/doc/CPU-Jitter-NPTRNG.pdf
https://pthree.org/2016/05/24/cpu-jitter-entropy-for-the-linux-kernel/
https://packages.debian.org/sid/jitterentropy-rngd


It would be a good alternative to haveged especially for hypervisors that don't support virtio-RNG and so don't have access to entropy sources early during boot process.


Details

Impact
Normal

Event Timeline

HulaHoop triaged this task as Normal priority.Jul 31 2018, 2:22 AM
HulaHoop created this task.
Patrick claimed this task.

consider installing jitterentropy-rngd to improve entropy collection
https://github.com/QubesOS/qubes-issues/issues/4169

Patrick updated the task description. (Show Details)

user@host:~/jitterentropy-20140131/tests_userspace/timing$ ./jitterentropy-inittest
Pass 10000 - Fail 0 - Rounds 10000

foldtime.O0
foldtime.O2

https://anonfile.com/g8E9mal5n6/foldtime_O2
https://anonfile.com/63H8m6l9nb/foldtime_O0

user@host:~/jitterentropy-20140131/tests_userspace/timing$ ./jitterentropy-inittest
Pass 10000 - Fail 0 - Rounds 10000

foldtime.O0
foldtime.O2

https://anonfile.com/g8E9mal5n6/foldtime_O2
https://anonfile.com/63H8m6l9nb/foldtime_O0

Could you please copy this over to https://github.com/smuellerDD/jitterentropy-rngd/issues/6#issuecomment-483191719 since jitterentropy developer was the one who requested it (and who can make head or tail of it).