Skip to content

Commit

Permalink
random: Add a kernel option to reduce the default fortuna poolsize
Browse files Browse the repository at this point in the history
This hack is insecure, but prevents blocking waiting for entropy in
environments without boot-time entropy such as existing FPGA setups.
  • Loading branch information
bsdjhb committed Jan 30, 2025
1 parent c7bb34a commit 5ef6058
Show file tree
Hide file tree
Showing 3 changed files with 11 additions and 0 deletions.
3 changes: 3 additions & 0 deletions sys/conf/options
Original file line number Diff line number Diff line change
Expand Up @@ -972,6 +972,9 @@ RANDOM_LOADABLE opt_global.h
# the uma slab allocator.
RANDOM_ENABLE_UMA opt_global.h
RANDOM_ENABLE_ETHER opt_global.h
# This is highly insecure but used in environments without any
# pre-boot entropy
RANDOM_NO_ENTROPY opt_global.h

# This options turns TPM into entropy source.
TPM_HARVEST opt_tpm.h
Expand Down
4 changes: 4 additions & 0 deletions sys/dev/random/fortuna.c
Original file line number Diff line number Diff line change
Expand Up @@ -81,7 +81,11 @@ CTASSERT(RANDOM_FORTUNA_BLOCKS_PER_KEY * RANDOM_BLOCKSIZE ==
* Making RANDOM_FORTUNA_DEFPOOLSIZE too large will mean a long time between reseeds,
* and too small may compromise initial security but get faster reseeds.
*/
#ifdef RANDOM_NO_ENTROPY
#define RANDOM_FORTUNA_MINPOOLSIZE 1
#else
#define RANDOM_FORTUNA_MINPOOLSIZE 16
#endif
#define RANDOM_FORTUNA_MAXPOOLSIZE INT_MAX
CTASSERT(RANDOM_FORTUNA_MINPOOLSIZE <= RANDOM_FORTUNA_DEFPOOLSIZE);
CTASSERT(RANDOM_FORTUNA_DEFPOOLSIZE <= RANDOM_FORTUNA_MAXPOOLSIZE);
Expand Down
4 changes: 4 additions & 0 deletions sys/dev/random/fortuna.h
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,11 @@

/* Defined in FS&K */
#define RANDOM_FORTUNA_NPOOLS 32 /* The number of accumulation pools */
#ifdef RANDOM_NO_ENTROPY
#define RANDOM_FORTUNA_DEFPOOLSIZE 1 /* The default pool size/length for a (re)seed */
#else
#define RANDOM_FORTUNA_DEFPOOLSIZE 64 /* The default pool size/length for a (re)seed */
#endif

#ifdef _KERNEL
typedef struct mtx mtx_t;
Expand Down

0 comments on commit 5ef6058

Please sign in to comment.