Messages in this thread | | | Date | Sun, 18 May 2008 08:24:10 -0400 | From | Theodore Tso <> | Subject | Re: [PATCH] drivers/net: remove network drivers' last few uses ofIRQF_SAMPLE_RANDOM |
| |
On Sun, May 18, 2008 at 03:02:36PM +0300, Adrian Bunk wrote: > > Yes that's the whole point. > > Why remove IRQF_SAMPLE_RANDOM if "it cannot make the RNG output worse." > > We should not care if network traffic can be sniffed in some configurations > > (plus sniffing could be very unlikely in some others). > >... > > Are network drivers better without SAMPLE_RANDOM? > > My understanding of openssl developper answer is same as yours : > > "it cannot make the RNG output worse." > > The "it cannot make the RNG output worse." only applies to the OpenSSL > case (one could argue whether it makes sense, but it can't do harm).
Actually, it applies here too. Or it can be made to apply here. If people are concerned that for certain cards the entropy could potentially be guessed by someone on the local network (although I suspect it's still useful for protecting against someone who doesn't have local network access), we could still sample the entropy, and just not increment the entropy credit for /dev/random's sake. It will still put something into the entropy pool which is also used by /dev/urandom.
> The replacement solution ready on all Linux machines today is for > userspace to use /dev/urandom instead of /dev/random if feasible.
Sampling interrupt entropy will definitely not hurt /dev/urandon, and may help, especially in the freshly installed server case. Especially if it's using kickstart-style install, where there is no keyboard entropy, sampling the interrupts as it pulls RPM's from the network and/or the CD-ROM drive may be all that we have.
- Ted
| |