News for hackers. Stuff that matters.

A comment on OpenSSH taking minutes to become available, booting takes half an hour (2018). Parent comment

Re:OpenSSH taking minutes to become available, booting takes... by ori_b on Wednesday July 17, 2019 @09:36PM (#20465875)
Thank god OpenBSD mixes in data from hardware RNGs, and the bootloader collects entropy as part of the boot process, effectively turning that exploit vector into a state level attack.
[ Parent | on HN ]
Re:OpenSSH taking minutes to become available, booting takes... by Dylan16807 on Wednesday July 17, 2019 @09:54PM (#20465976)
But if you're imaging a drive and also RDRAND fails, OpenBSD is just as vulnerable to attack. See also AMD for RDRAND failing entirely.
[ Parent | on HN ]
Re:OpenSSH taking minutes to become available, booting takes... by ori_b on Wednesday July 17, 2019 @09:59PM (#20466004)
Yeah, that's why the bootloader also gathers entropy as it's coming up.

But, at some point nobody can save you from yourself entirely. Get a broken enough system, and every security feature will fail.

[ Parent | on HN ]
Re:OpenSSH taking minutes to become available, booting takes... by Dylan16807 on Wednesday July 17, 2019 @10:05PM (#20466043)
The bootloader collects some, but I doubt it reliably collects enough all by itself.
[ Parent | on HN ]
Re:OpenSSH taking minutes to become available, booting takes... by ori_b on Wednesday July 17, 2019 @10:47PM (#20466256)
How much do you think is enough, and why do you think the amount collected during boot is insufficient?
[ Parent | on HN ]
Re:OpenSSH taking minutes to become available, booting takes... by Dylan16807 on Wednesday July 17, 2019 @10:55PM (#20466292)
Let's say 300 bits.

I'm assuming a bootloader can't collect more in three seconds than an OS can collect in multiple minutes. Is that assumption wrong?

If it's the design of the code that lets it collect entropy faster, then it's that code that needs to be ported, and it doesn't matter if it's in a bootloader or not except to save a second or two.

[ Parent | on HN ]
Re:OpenSSH taking minutes to become available, booting takes... by vbezhenar on Thursday July 18, 2019 @01:17AM (#20466946)
300 true random bits is a lot. Even something like 128 bits is unbreakable with available hardware.
[ Parent | on HN ]