Re: [PATCH v2 2/4] random: simplify entropy debiting

[Dominik Brodowski]

Am Fri, Feb 04, 2022 at 02:53:23PM +0100 schrieb Jason A. Donenfeld:
> Our pool is 256 bits, and we only ever use all of it or don't use it at
> all, which is decided by whether or not it has 128 bits in it. So we can

	"has at least"

> drastically simplify the accounting and cmpxchg loop to do exactly this.
> While we're at it, we move the minimum bit size into a constant so it
> can be shared between the two places where it matters.
> 
> The reason we want any of this is for the case in which an attacker has
> compromised the current state, and then bruteforces small amounts of
> entropy added to it. By demanding a particular minimum amount of entropy
> be present before reseeding, we make that bruteforcing difficult.
> 
> Note that this rationale no longer includes anything about /dev/random
> blocking at the right moment, since /dev/random no longer blocks (except
> for at ~boot), but rather uses the crng. In a former life, /dev/random
> was different and therefore required a more nuanced account(), but this
> is no longer.
> 
> Behaviorally, nothing changes here. This is just a simplification of
> the code.
> 
> Cc: Theodore Ts'o <tytso@xxxxxxx>
> Cc: Dominik Brodowski <linux@xxxxxxxxxxxxxxxxxxxx>
> Cc: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
> Signed-off-by: Jason A. Donenfeld <Jason@xxxxxxxxx>

Reviewed-by: Dominik Brodowski <linux@xxxxxxxxxxxxxxxxxxxx>

Thanks,
	Dominik