News for hackers. Stuff that matters.

A comment on /dev/random and virtual systems. Parent comment

Re:/dev/random and virtual systems by stipes on Sunday May 29, 2011 @02:18PM (#2597138)
Part of the problem is the conflict of transparency and security here. Fixing the wholesale reuse of RNG state would most likely require modifying the guest so that it is aware of being restarted from a snapshot so it can react appropriately.

However, that might have consequences on what restoring from a snapshot means conceptually.

[ Parent | on HN ]
Re:/dev/random and virtual systems by yuhong on Sunday May 29, 2011 @03:49PM (#2597392)
How about having a command to manually reseed the PRNG?
[ Parent | on HN ]
Re:/dev/random and virtual systems by tptacek on Sunday May 29, 2011 @04:27PM (#2597500)
You mean like write(2)? :)
[ Parent | on HN ]
Re:/dev/random and virtual systems by stipes on Sunday May 29, 2011 @07:52PM (#2597950)
Yes, in general write to /dev/random with the write permissions is how entropy gathering daemons and the like work. It gets added the input and mixed in. However, that doesn't fix the issue of how a snapshot restore works on most hypervisors. Adding an RNG refresh as part of the restore process could be possible, but definitely not trivial, and it could have other consequences if not carefully implemented.
[ Parent | on HN ]