Messages in this thread | | | Date | Tue, 28 Sep 2004 15:46:11 +0200 | From | Herbert Poetzl <> | Subject | Re: [PROPOSAL/PATCH] Fortuna PRNG in /dev/random |
| |
On Mon, Sep 27, 2004 at 10:24:09PM -0400, Jean-Luc Cooke wrote: > On Mon, Sep 27, 2004 at 08:07:19PM -0400, Theodore Ts'o wrote: > > On Mon, Sep 27, 2004 at 03:45:02PM -0400, Jean-Luc Cooke wrote: > > > > Actually trying to replace the partial MD4 might be worth an attempt: > > > > I'm certain that the partial MD4 is not the best/fastest way to generate > > > > sequence numbers. > > > > > > It infact uses two full SHA1 hashs for tcp sequence numbers (endian and > > > padding issues aside). my patch aims to do this in 1 AES256 Encrypt or 2 > > > AES256 encrypts for ipv6. > > > > No, that's not correct. We rekey once at most every five minutes, and > > that requires a SHA hash, but in the normal case, it's only a partial MD4. > > Pardon, the SYN cookies use two SHA1's, not the TCP sequence numbers. Easy > to mistake to make with comments "Compute the secure sequence number." in the > secure_tcp_syn_cookie() function. :) > > > An AES encrypt for every TCP connection *might* be faster, but I'd > > want to time it to make sure, and doing a bulk test ala "openssl > > speed" isn't necessarily going to be predictive, as I've discussed earlier. > > Agreed. > > Was meaning to ask: > add_timer_randomness() > > There is a comment: > /* if over the trickle threshold, use only 1 in 4096 samples */ > if ( random_state->entropy_count > trickle_thresh && > (__get_cpu_var(trickle_count)++ & 0xfff)) > return; > > "if (x++ & 0xfff)" will return true 0xfff out of 0x1000 of the time. Is this > the goal, because I don't think this will trickle control very well.
and it will 'return' 0xfff times of 0x1000 ...
(just one case (x == 0) will pass this check)
best, Herbert
> JLC > - > To unsubscribe from this list: send the line "unsubscribe linux-kernel" in > the body of a message to majordomo@vger.kernel.org > More majordomo info at http://vger.kernel.org/majordomo-info.html > Please read the FAQ at http://www.tux.org/lkml/ - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |