Linux To Better Protect Entropy Sent In From User-Space

[V10lator]

What uses random on boot?

I'm using encrypted swap space with a randomly generated key (remember: Swap space may contain sensitive information and store it on disc for a long time). Said key gets generated at each boot. With just what the kernel offers the boot hangs for around 15 minutes waiting for entropy... A workaround for that would be using /dev/urandom instead of /dev/random but that would mean less entropy/randomness is being used so it's a no-go or changing the haveged systemd unit to start up earlier. In fact this boot issue is why I started AtomicRNG (but it stalled as modifying the haveged systemd unit is more simple and I'm lazy).

A fair number of people don't trust the Intel RdRand generator to be truly random and could be bugged by spy agencies like the NSA, but in this case it's simply being mixed in with entropy supplied by user-space: so it adds some value regardless

IIRC the entropy pool is as strong as its strongest source, so adding things in can't weaken it but only make it stronger. I call that a good thing.

[shmerl]

I might be in the same situation. Waiting for sddm to show up is definitely the longest part of my boot process.

It seems like a bug in sddm, as I don't see why it should need cryptographic-quality random numbers at all.

I'm not hitting this issue on another machine, though.

I'm not sure why sddm needs that exactly. It was very hard to identify the issue, I eventually found someone mentioning it, and suggested method of using better quality entropy generator worked. I tested it with rng-tools5 and it works around the problem. Some suggestged using haveged, but rng-tools5 is better since it's using hardware for it.

See:

https://github.com/sddm/sddm/issues/1036

https://www.reddit.com/r/archlinux/c...taking_a_long/

[akostadinov]

The issue usually happens on first boot of VMs because seed from last boot does not exist yet. As already mentioned rng-tools in Fedora and Red Hat Enterprise Linux and CentOS already supports jitter entropy [1]. Difference between random and urandom are explained [2] and [3]. In short not much different in general but might be different early during boot process.

HTH

[1] https://access.redhat.com/solutions/3236341
[2] https://access.redhat.com/articles/3672591
[3] https://www.2uo.de/myths-about-urandom