From: Rob Kendrick <rjek@rjek.com>
To: gentoo-hardened@lists.gentoo.org
Subject: Re: [gentoo-hardened] Bought an "entropy-key" - very happy
Date: Thu, 25 Mar 2010 20:21:02 +0000 [thread overview]
Message-ID: <20100325202102.496a1eb6@trite.i.flarn.net.i.flarn.net> (raw)
In-Reply-To: <4BABC4C8.2080603@wildgooses.com>
On Thu, 25 Mar 2010 20:17:12 +0000
Ed W <lists@wildgooses.com> wrote:
> > out of curiosity, what's that mean exactly?
> >
> I believe that the random numbers are encrypted out of the device? I
> say that because when you start up the userspace daemon you tell it a
> long random number supplied with the device. I assume this is
> designed to make sure that some local process can't sniff the entropy
> (over the USB bus, or whatever) before it's added to the kernel pool?
Pretty much. It is worth noting that the entropy is decrypted before
being added to the pool; it's not just a whitening scheme.
(Rootly processes can, of course, pretty much know whatever they want
to. The encryption and hand shaking is there to prevent physical
access to the outside of the case being as much of an issue.)
B.
next prev parent reply other threads:[~2010-03-25 20:21 UTC|newest]
Thread overview: 20+ messages / expand[flat|nested] mbox.gz Atom feed top
2010-03-23 20:39 [gentoo-hardened] Bought an "entropy-key" - very happy Ed W
2010-03-23 21:02 ` lists
2010-03-25 13:10 ` Rob Kendrick
2010-03-25 17:50 ` pageexec
2010-03-25 20:12 ` Rob Kendrick
2010-03-25 19:38 ` pageexec
2010-03-25 23:53 ` Ed W
2010-03-26 0:36 ` Rob Kendrick
2010-03-25 20:17 ` Ed W
2010-03-25 20:21 ` Rob Kendrick [this message]
2010-03-25 13:30 ` Ed W
2010-03-25 19:23 ` lists
2010-03-25 19:34 ` Tóth Attila
2010-03-25 20:11 ` Rob Kendrick
2010-03-25 20:34 ` Ed W
2010-03-25 20:41 ` RB
2010-03-25 21:08 ` Tom Hendrikx
2010-03-26 14:15 ` Brian Kroth
2010-03-26 15:19 ` Rob Kendrick
2010-03-27 13:11 ` Ed W
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20100325202102.496a1eb6@trite.i.flarn.net.i.flarn.net \
--to=rjek@rjek.com \
--cc=gentoo-hardened@lists.gentoo.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox