[PATCH] Require minimum random data entropy when creating LUKS (#1073679)

Brian C. Lane bcl at redhat.com
Sat Aug 30 00:24:52 UTC 2014


On Fri, Aug 29, 2014 at 02:20:03PM +0200, Vratislav Podzimek wrote:
> Creating new LUKS format requires high-quality random data and such quality may
> be specified by minimum entropy of kernel's random data pool required. We can
> tell blivet what should be the minimum entropy available when creating LUKS and
> we can provide callbacks which inform users about what's happening and how they
> can help to increase the available entropy.

Some somewhat random (bad pun) thoughts:

Normal users aren't going to have the slightest idea what this means, we
should do as much as we can to hide it from them. Before showing the
dialog set a timer of, say, 15 seconds and then if there isn't enough
show it.

Are we sure this is the right way to proceed? I'd expect LUKS to make
sure it has sufficient entropy, but I haven't looked at its code. Ok, I
read the manpage and it suggests using /dev/random if running out of
entropy is an issue.

When I was thinking about adding rngd to the install I came across an
analysis of the entropy pool on VMs, and IIRC the conclusion was that
the kernel pretty much does the right thing and extra help wasn't
needed. Of course I can't find the paper now.

There is also a chance that these checks and enforcement don't help, eg.
something drains the pool at the same time LUKS needs it, but after
we've checked for it. Instead of waiting for enough entropy maybe it
should switch LUKS to using /dev/random so it blocks until enough shows
up.

-- 
Brian C. Lane | Anaconda Team | IRC: bcl #anaconda | Port Orchard, WA (PST8PDT)


More information about the anaconda-patches mailing list