On Mon, Sep 24, 2018 at 04:40:13PM -0700, Jon Olson wrote:
+tytso@mit.edu -- Ted, I know you had some thoughts on seeding virtio-rng from /dev/urandom (not sure the listserv will let you post, but it should catch at least Sebastien and I).
From a guest perspective, you have to trust the Host system anyway. The host as the ability to read or modify arbitrary guest memory, including that used by the kernel. The host can mess with the guest kernel before it's booted, or change the contents of the emulated hard drive. So trusting that the host CPU has implemented RDRAND correctly isn't a stretch. So even if the customer running the VM is a tin-foil-hatter who believes the NSA may have backdoored RDRAND and not have it be discovered or leaked out, in most cases, they aren't
My recommendation is to just seed virtio-rng from /dev/urandom. Here's why. /dev/urandom provides a cryptographic random number generator, and assuming it is adequately initialized, that should be *fine* for pretty much all practical purposes. And on the sort of systems you would be using as a Host, there are enough hardware devices that /dev/urandom will be initialized very quickly --- in practice, well before any VM's will be started. Furthermore, all modern x86 systems have RDRAND by now, and on those systems, the host kernel will mix RDRAND output with CRNG before sending the random numbers out via getrandom(2) or /dev/urandom. the sort of people who would want to use a cloud infrastructure. They're much more likely to want to use hardware which always stays under their personal control. And even if you *do* believe the NSA has somehow managed to sneak a backdoor into Intel CPU designs without it become public, that still means that you have to break the CRNG. And practically speaking, assuming it's been initialized correctly, if you can break the CRNG, we've got much bigger problems, since that implies you can't trust the basic crypto primitives we use to secure our entire internet. Cheers, - Ted