Re: getrandom vs. crypto/gc-random

[Bruno Haible]

Hi Jeffrey,

I'm trying to state in simple-to-understand words what Simon said
about getrandom(), getentropy(), and libgcrypt.

If you have a better wording, please submit a patch.

> Nowadays it may be prudent to simply state the data returned from the
> prng should be treated as a seed and not used directly.

Why? Why would it not be OK to use it in tempname(), for example?
Whether the number come from an in-kernel pseudo-random-number generator
or from a user-mode pseudo-random-number generator, doesn't change
things.

> For folks who need crypto parameters, suggest they use
> Krawczyk's HDKF to extract the entropy from the seed and expand it.
> HKDF provides provable security properties and Krawczyk provides the
> analysis.

If the algorithm you mean is already contained libgcrypt, referring to
libgcrypt should be enough, no? If not, and if Krawczyk's algorithm
is as important as you present it, why is it not in libgcrypt?

> I would avoid labels like "low quality" and "high quality".

Is "crypto-strength", as Simon formulated it, a better term? IMO, it
requires a bit of knowledge, to understand that "crypto-strength" means
"very high quality".

Also, there are no absolute terms, I guess - since it depends on the
OS, and the OSes are getting better over time.

> It is
> impossible to judge at runtime without auditing mechanisms in place
> operating on the returned data. Even trying to pick a test at runtime
> to judge the stream is like trying to pin jello to a wall.

Do you have time to analyze the strength of getrandom() and
getentropy() on a dozen of platforms? I don't. Therefore I can't put
in more than a subjective measurement.

> Also, it looks like (to me) getrandom may suffer VM rollback attacks.
> So claiming a stream is high quality may be questionable if a reboot
> produces the same stream.

On which systems does getrandom() have this problem? Also, it surely
depends on the way it's configured. If it has a network interface to the
host machine, and the number of packets per second on that network interface
is used as an entropy source, there should be no problem.

I don't wish to enter to a time-consuming dialogue about security.
All I wish is to have a reasonably short and understandable piece of text
for the Gnulib documentation.

Bruno