On Mon 6 Apr 2009 19:35, Jeff Garzik pondered:Sven-Haegar Koch wrote:On Mon, 6 Apr 2009, Matt Mackall wrote:We see this question every time IRQF_SAMPLE_RANDOM is discussed.
On Mon, 2009-04-06 at 14:30 -0400, Robin Getz wrote:Btw, perhaps not the perfect question in this thread:We have lots of embedded headless systems (no keyboard/mouse, noI'd rather add a random_sample_network call somewhere reasonably central
soundcard, no video) systems with *no* sources of entropy - and people
using SSL.
in the network stack. Then we can use the knowledge that the sample is
network-connected in the random core to decide how to measure its
entropy. The trouble with IRQF_SAMPLE_RANDOM is that many of its users
are technically bogus as entropy sources in the current model.
I'm eventually going to move the RNG away from the strict theoretical
entropy accounting model to a more pragmatic one which will be much
happier with iffy entropy sources, but that's a ways off.
But what should we use to keep servers running without a hardware rng available and without any external input besides the network?
After having ssh and openvpn die because of no random and having the machines like dead and unreachable for me I use "ln -sf /dev/urandom /dev/random", but that does not feel so good.
There is plenty of entropy data available, you just have to look around... Google around for "EGD", video entropy daemon, audio entropy daemon, etc...
Even headless servers have entropy sources if you look hard enough.
The original question wasn't headless servers - it was headless, no audio, no video, boot from flash, (initrd root file systems), diskless. embedded devices.
And few want to load up perl on an embedded device just to gather entropy. :(