Re: [PATCH v43 01/15] Linux Random Number Generator

[Simo Sorce]

On Mon, 2021-11-22 at 07:55 +0100, Greg Kroah-Hartman wrote:
> On Mon, Nov 22, 2021 at 07:42:02AM +0100, Stephan Mueller wrote:
> > Am Montag, 22. November 2021, 07:02:14 CET schrieb Greg Kroah-Hartman:
> > 
> > Hi Greg,
> > 
> > > On Mon, Nov 22, 2021 at 06:34:43AM +0100, Stephan Mueller wrote:
> > > > Am Sonntag, 21. November 2021, 23:42:33 CET schrieb Jason A. Donenfeld:
> > > > 
> > > > Hi Jason,
> > > > 
> > > > > Hi Stephan,
> > > > > 
> > > > > You've posted it again, and yet I still believe this is not the
> > > > > correct design or direction. I do not think the explicit goal of
> > > > > extended configurability ("flexibility") or the explicit goal of being
> > > > > FIPS compatible represent good directions, and I think this introduces
> > > > > new problems rather than solving any existing ones.
> > > > 
> > > > The members from the Linux distributions that are on copy on this may tell
> > > > you a different story. They all developed their own downstream patches to
> > > > somehow add the flexibility that is needed for them. So, we have a great
> > > > deal of fragmentation at the resting-foundation of Linux cryptography.
> > > 
> > > What distros specifically have patches in their kernels that do
> > > different things to the random code path?  Do you have pointers to those
> > > patches anywhere?  Why have the distros not submitted their changes
> > > upstream?
> > 
> > I will leave the representatives from the distros to chime in and point to 
> > these patches.
> 
> Then why not work with the distros to get these changes merged into the
> kernel tree?  They know that keeping things out-of-the-tree costs them
> time and money, so why are they keeping them there?

I can speak for my distro.
We have not proposed them because they are hacks, we know they are
hacks, and we know they are not the long term solution.
Yet we have no better way (in our products, today) so far to deal with
these issues because what is needed is an effort like LRNG (does not
have to be this specific implementation), because hacks will not cut it
in the long term.

> I recommend getting the distros to chime in on what their requirements
> are for the random code would probably be best as they are the ones that
> take on the "random fips requirement of the day" more than anyone else.

Greg,
I think you can takes Stephan's introduction and supporting material
from this patchset to see what are the requirements. These patches have
not been maturing in a void, but Stephan basically distilled
discussions between multiple vendors as well as regulatory bodies (as
you can see he has reviews from BSI and NIST requirements are also
fully represented here).

He addressed a few aspects I can mention but are not the only ones:
performance (esp on NUMA systems), not blocking at boot due to lack of
entropy, NIST/BSI conformance, flexibility so that future regulatory
requirements can be easily integrated and upstreamed.


> > Yet, these changes are commonly a band-aid only that have some additional 
> > drawbacks. Bottom line, there is no appropriate way with the current code to 
> > allow vendors what they want to achieve. One hint to what changes vendors are 
> > attempting can be found in [1] slide 20.
> 
> What exactly do vendors "want to achieve"?  Where are they saying this?
> 
> > [1] https://www.chronox.de/lrng/doc/lrng_presentation_v43.pdf
> 
> I see nothing on that slide that mentions actual requirements other than
> "the current code does not match this random government regulation".
> 
> Please provide valid reasons, from distros.
> 

Please let me know in what format you want to see these requirements,
and I will work with other to provide them.

Simo.


> thanks,
> 
> greg k-h
> 

-- 
Simo Sorce
RHEL Crypto Team
Red Hat, Inc