{"id":7966,"date":"2014-10-13T09:26:02","date_gmt":"2014-10-13T07:26:02","guid":{"rendered":"http:\/\/djalil.chafai.net\/blog\/?p=7966"},"modified":"2014-10-14T19:16:26","modified_gmt":"2014-10-14T17:16:26","slug":"linux-kernel-3-17","status":"publish","type":"post","link":"https:\/\/djalil.chafai.net\/blog\/2014\/10\/13\/linux-kernel-3-17\/","title":{"rendered":"Linux kernel 3.17 getrandom()"},"content":{"rendered":"
\"Linux<\/a>
Linux Tux<\/figcaption><\/figure>\n

Linus Torvalds<\/a> has just released<\/a> the Linux kernel<\/a>\u00a0version 3.17. Among other things, it comes with a new system call<\/a> for random numbers<\/a>\u00a0named\u00a0getrandom()<\/strong>\u00a0introduced by Theodore Ts'o<\/a>\u00a0for the needs of applications such as LibreSSL<\/a>. This new system call can be used to emulate the getentropy() <\/tt><\/strong>of OpenBSD<\/a>. Such random numbers are not algorithmic, and their unpredictability is useful for cryptographic and security applications.\u00a0More information is available on Linux Weekly News<\/a>.<\/p>\n

Excerpt from the\u00a0commit<\/a>\u00a0in the Git <\/a> repository of the Linux kernel source:<\/p>\n

\n

The getrandom(2) system call was requested by the LibreSSL Portable
\ndevelopers. It is analoguous to the getentropy(2) system call in
\nOpenBSD.<\/p>\n

The rationale of this system call is to provide resiliance against
\nfile descriptor exhaustion attacks, where the attacker consumes all
\navailable file descriptors, forcing the use of the fallback code where
\n\/dev\/[u]random<\/a> is not available. Since the fallback code is often not
\nwell-tested, it is better to eliminate this potential failure mode
\nentirely.<\/p>\n

The other feature provided by this new system call is the ability to
\nrequest randomness from the \/dev\/urandom entropy pool, but to block
\nuntil at least 128 bits of entropy has been accumulated in the
\n\/dev\/urandom entropy pool. Historically, the emphasis in the
\n\/dev\/urandom development has been to ensure that urandom pool is
\ninitialized as quickly as possible after system boot, and preferably
\nbefore the init scripts start execution.<\/p>\n

This is because changing \/dev\/urandom reads to block represents an
\ninterface change that could potentially break userspace which is not
\nacceptable. In practice, on most x86 desktop and server systems, in
\ngeneral the entropy pool can be initialized before it is needed (and
\nin modern kernels, we will printk a warning message if not). However,
\non an embedded system, this may not be the case. And so with this new
\ninterface, we can provide the functionality of blocking until the
\nurandom pool has been initialized. Any userspace program which uses
\nthis new functionality must take care to assure that if it is used
\nduring the boot process, that it will not cause the init scripts or
\nother portions of the system startup to hang indefinitely.<\/p>\n<\/blockquote>\n

Notes.<\/strong>\u00a0LibreSSL is a free\u00a0version of the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, forked from OpenSSL\u00a0cryptographic software library in April 2014 by\u00a0OpenBSD developers after the Heartbleed security vulnerability in OpenSSL<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"

Linus Torvalds has just released the Linux kernel version 3.17. Among other things, it comes with a new system call for random numbers named getrandom() introduced by Theodore Ts'o for…<\/p>\n

Continue readingLinux kernel 3.17 getrandom()<\/span><\/a><\/div>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"iawp_total_views":133},"categories":[1],"tags":[],"_links":{"self":[{"href":"https:\/\/djalil.chafai.net\/blog\/wp-json\/wp\/v2\/posts\/7966"}],"collection":[{"href":"https:\/\/djalil.chafai.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/djalil.chafai.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/djalil.chafai.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/djalil.chafai.net\/blog\/wp-json\/wp\/v2\/comments?post=7966"}],"version-history":[{"count":19,"href":"https:\/\/djalil.chafai.net\/blog\/wp-json\/wp\/v2\/posts\/7966\/revisions"}],"predecessor-version":[{"id":7989,"href":"https:\/\/djalil.chafai.net\/blog\/wp-json\/wp\/v2\/posts\/7966\/revisions\/7989"}],"wp:attachment":[{"href":"https:\/\/djalil.chafai.net\/blog\/wp-json\/wp\/v2\/media?parent=7966"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/djalil.chafai.net\/blog\/wp-json\/wp\/v2\/categories?post=7966"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/djalil.chafai.net\/blog\/wp-json\/wp\/v2\/tags?post=7966"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}