* Whaley, Graham (graham.whaley@intel.com) wrote:
From: Marco Vedovati [mailto:mvedovati@suse.com] [snip] In my view, given the ephemeral aspect of containers, /dev/urandom should be fine most of the time. As an option, user should be left the possibility to select /dev/random if that is needed for his specific application.
From a read around, I agree with the sentiment, that /dev/urandom is . I'm not sure how that ties in with QEMU/KVM though - if we direct QEMU to use the host /dev/urandom, does that mean that the guest /dev/random is really using the host /dev/urandom - so any strong /dev/random guarantees inside the guest are now a lie... I don't know how the virtio rng and qemu hang together etc.
virtio-rng in the guest kernel provides queues that qemu services and provides data from whichever source you specify. The guest kernel then passes the data from vrtio-rng through the hwrng code into the main random code where it goes through mix_pool_bytes so as far as I understand that's mixed in with anything else. However; my reading of hwrng is that there's only one 'current' hwrng generator (as opposed to other entropy sources) and that's whichever one has the highest 'quality'. virtio-rng proudly claims a quality of 1000 - and doesn't really know what it's been passed from qemu. Dave
BTW, it may be worth investigating on what is the state of the art solution chosen in virtualization systems with a high VM count.
+1 I doubt we are the first people to run into this scenario.
Marco
Graham --------------------------------------------------------------------- Intel Corporation (UK) Limited Registered No. 1134945 (England) Registered Office: Pipers Way, Swindon SN3 1RJ VAT No: 860 2173 47
This e-mail and any attachments may contain confidential material for the sole use of the intended recipient(s). Any review or distribution by others is strictly prohibited. If you are not the intended recipient, please contact the sender and delete all copies. _______________________________________________ kata-dev mailing list kata-dev@lists.katacontainers.io http://lists.katacontainers.io/cgi-bin/mailman/listinfo/kata-dev -- Dr. David Alan Gilbert / dgilbert@redhat.com / Manchester, UK