Messages in this thread | | | Date | Thu, 1 Nov 2018 22:13:18 -0400 | From | "Theodore Y. Ts'o" <> | Subject | Re: Bug#912087: openssh-server: Slow startup after the upgrade to 7.9p1 |
| |
On Fri, Nov 02, 2018 at 01:24:25AM +0100, Kurt Roeckx wrote: > Anyway, on my laptop I get: > [ 12.675935] random: crng init done > > If the TPM is enabled, I also have an /etc/hwrng, but rng-tools is > started later after the init is done. > > On my desktop (with a chaos key attached) > [ 3.844484] random: crng init done > [ 5.312406] systemd[1]: systemd 239 running in system mode.
Starting with the 3.17 kernel, the kernel will automatically pull from hardware random number generators without needing to install a user space daemon, such as rng-tools. For most hardware devices, it is not enabled by default, so you have to enable by adding something like "rng_core.default_quality=700" to the kernel boot line.
There are *two* devices which are an exception to this rule. The first is virtio_rng, since the assumption is if you are using a VM, you had better trust the host infrastructure or you have much worse problems. The second is the driver for the Chaos Key. That appears to be because the author of the driver for the Chaos Key wasn't aware of the general policy that hardware rng's shouldn't be trusted by default, and the driver was coded violating that policy.
This is why (with a chaos key attached) you see the "crng init done" message so early, *before* the root file system is mounted. (The root file system gets mounted after the "systemd running in system mode" message is logged.)
This is better than relying on rng-toonls, since we can initialize the CRNG must earlier in the boot process. (It should have been the case that this would only happen if you configured by setting the rng_core.default_quality parameter, but see above about how the Chaos Key driver is currently violating policy.)
In the future I should change the kernel so you can explicitly specify something like tpm.rng_quality=500 and chaos_key.rng_quality=1000 on the boot command line. That way the system administrator can be very explicit about which hwrng they trust; right now what we have is not ideal since it's not clear which hwrng the system administrator wanted to configure as trusted, and if you have more than one hwnrg in the system (say, a closed source, proprietary tpm, and an open hardware Chaos Key) you can't say which one you want to have trusted.
Cheers,
- Ted
| |