[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <54540CD9.3070901@amacapital.net>
Date: Fri, 31 Oct 2014 15:27:37 -0700
From: Andy Lutomirski <luto@...capital.net>
To: musl@...ts.openwall.com
Subject: Re: magic constants in some startup code
On 10/31/2014 02:39 PM, Rich Felker wrote:
> On Fri, Oct 31, 2014 at 02:29:32PM -0700, Andy Lutomirski wrote:
>>>> For example, musl could implement a trivial DRBG seeded by AT_RANDOM and
>>>> replace the AT_RANDOM data with the first output from the DRBG at
>>>> startup. Then getauxval users are safe and musl can also have a stream
>>>> of decent random numbers for internal use.
>>>
>>> This imposes a large code size cost in the mandatory startup code even
>>> on programs that have no interest in AT_RANDOM (99% or more). Instead,
>>> the first call to getauxval could do this, though, but I'm not sure
>>> it's a good approach anyway. Linux has added the getrandom syscall
>>> which can provide the BSD getentropy function or the more featureful
>>> getrandom API, so using getauxval(AT_RANDOM) seems like a bad idea.
>>> Even if we avoided reuse of the same data that went into the canary,
>>> there's no way for callers using getauxval(AT_RANDOM) to tell whether
>>> some other library code in the same process has already consumed
>>> entropy from AT_RANDOM, so using it is not library-safe. It seems like
>>> we should try to discourage use of getauxval(AT_RANDOM) as an entropy
>>> source rather than giving false hope that it's safe.
>>
>> getrandom(2) has the annoying problem that you can't ask it for
>> best-effort entropy. This caused systemd to add a /dev/urandom fallback
>> a few days ago (sigh).
>
> Is best-effort ever useful? My feeling is that either you need
> cryptographic quality entropy, in which case it's not acceptable to
> get something fake, or you don't, in which case you can use something
> like the clock. Maybe I'm misunderstanding what you mean by
> best-effort. My impression was that getrandom was equivalent to
> /dev/urandom, not the tin-foil-hattery that is /dev/random.
The clock really sucks for entropy. There are systems on which it's
entirely plausible that two different processes will start in rapid
succession and get exactly the same value out of the clock.
>
>> Maybe I'll try to get a GRND_BESTEFFORT flag for getrandom into the
>> kernel. I suppose that a musl getrandom wrapper could emulate that flag
>> (only) or something on older kernels. Or maybe glibc and musl could
>> both agree to add some get_sort_of_decent_entropy function based on
>> AT_RANDOM.
>
> Really you can provide perfecty good random numbers for cryptographic
> purposes with just AT_RANDOM as a seen and a proper csprng. My
> understanding of the motivation for fancier stuff is a (misguided,
> IMO) idea that sequences in the parent and child should be independent
> after fork.
The problems with AT_RANDOM and with getrandom(2) involve early boot.
Newer kernels (especially on ARM, apparently) can boot quickly enough
that the RNG is in terribly shape when userspace starts. AT_RANDOM will
contain something, regardless, but it might have rather little entropy.
getrandom(2) will refuse to operate at all until the kernel thinks it
has 128 bits or so of entropy.
So, if you want entropy at process start, AT_RANDOM is the best you can
do. But you should seed a per-process csprng with it if you can avoid
it, or at least you should reseed with getrandom, since the kernel RNG
will eventually end up being cryptographically secure.
IOW, there isn't really a great solution here.
I am, however, quite convinced that different sequences after fork is
important. Otherwise you can have catastrophic failures, e.g. if you do
fork(); compute_dsa_signature();
--Andy
>
>>>> If you think this is a good idea, I could implement it. The main
>>>> downside would be that it'll require some crypto primitive. There's
>>>> already a SHA-256 implementation in musl that could be reused, but it
>>>> would be a bit unfortunate to pull it in to all musl-linked static binaries.
>>>
>>> Yes, code size is a concern, but it could be tucked away as a
>>> dependency of other functions instead of being a dependency of the
>>> startup code.
>>
>> Most or all existing getauxval users are unlikely to be using AT_RANDOM,
>> so doing this without any bloat might be hard.
>
> Yes, this is a good point.
>
> Rich
>
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
