Skip to content

Commit

Permalink
Update README.md
Browse files Browse the repository at this point in the history
  • Loading branch information
jirka-h authored Mar 7, 2022
1 parent 00fd6e5 commit bfff89f
Showing 1 changed file with 8 additions and 11 deletions.
19 changes: 8 additions & 11 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -4,20 +4,17 @@ Haveged, an entropy source

IMPORTANT UPDATE

Starting from Linux kernel v5.6, the HAVEGED **service** has become obsolete. The userspace application as well as the haveged library are not affected. There are two main reasons for that:
Starting from Linux kernel v5.6, the HAVEGED inspired algorithm has been included in the Linux kernel (see the [LKML article]( https://lore.kernel.org/lkml/[email protected]/T/) and the Linux Kernel [commit](https://github.com/torvalds/linux/commit/30c08efec8884fb106b8e57094baa51bb4c44e32)). As soon as the CRNG (the Linux cryptographic-strength random number generator) gets ready, `/dev/random` does not block on reads anymore.

1) The mainline Linux Kernel has now HAVEGED algorithm build in internally, see the [LKML article.]( https://lore.kernel.org/lkml/[email protected].de/T/)
I'm happy that these changes made it into the mainline kernel. It's pleasing to see that the main idea behind HAVEGED has sustained time test - it was published already in 2003 [here.](https://www.irisa.fr/caps/projects/hipsor/publications/havege-tomacs.pdf) I'm also glad that the HAVEGE algorithm is being further explored and examined - see the [CPU Jitter Random Number Generator.](https://www.chronox.de/jent.html)

2) Furthermore, as soon as the CRNG (the Linux cryptographic-strength random number generator) gets ready, `/dev/random` does not block on reads anymore. See the [kernel commit.](https://github.com/torvalds/linux/commit/30c08efec8884fb106b8e57094baa51bb4c44e32)
It means that HAVEGED **service** is now less relevant. However, it's still useful in the following situations, when you
* need randomness early in the boot process, before the CRNG in the Linux kernel gets fully initialized.

This comment has been minimized.

Copy link
@calestyo

calestyo Mar 19, 2022

I thought the kernel would now also initialise fast?

This comment has been minimized.

Copy link
@jirka-h

jirka-h Mar 22, 2022

Author Owner

Well, there are still some scenarios and platforms where it can take a while. See the discussion here for example:
#57 (comment)

crg init takes 40 seconds.

This comment has been minimized.

Copy link
@calestyo

calestyo Mar 22, 2022

Hmm I see... IIRC, I read something recently, not sure whether it was LWN or Jason Donenfeld's blog, that in current kernels it should be at most 1s where it blocks.

* want to deploy an additional entropy source. HAVEGED now inserts entropy into the kernel every 60 seconds, regardless of the entropy level reported by Linux Kernel. It does not affect the `/dev/random` read speed but it diversifies the entropy sources, making the Linux Kernel CRNG more robust.

This comment has been minimized.

Copy link
@calestyo

calestyo Mar 19, 2022

Does it add any other kind of entropy? I mean when the kernel itself uses already CPU jitter, isn't that basically the same?

This comment has been minimized.

Copy link
@jirka-h

jirka-h Mar 22, 2022

Author Owner

While the main idea - using CPU jitter as the source of entropy - is the same, the implementation is completely different. In this sense, it is another source of entropy.

Some users (and I'm one of them) prefer to have another source of entropy deployed - see for example here:
#57 (comment)

This comment has been minimized.

Copy link
@calestyo

calestyo Mar 22, 2022

I see.. thanks for the information. Perhaps it would be good to add that detail (i.e. same entropy source, but different implementation) to the readme, so that people can better decide.

Thx! :-)

This comment has been minimized.

Copy link
@jirka-h

jirka-h Mar 31, 2022

Author Owner

Good point! I have added it to README now - check this commit

66323fb

This comment has been minimized.

Copy link
@calestyo

calestyo Mar 31, 2022

Great :-)

This comment has been minimized.

Copy link
@jirka-h

jirka-h Mar 31, 2022

Author Owner

Thanks for the review! 😃

* you are looking for userspace RNG to generate random numbers. See `man -S8 haveged` for examples or try running `haveged -n 0 | pv > /dev/null`
* and last but not least, most Linux installations are still running on the older kernel versions.

I'm happy that these changes made it into the mainline kernel. It's nice to see that the main idea behind HAVEGED has sustained time test- it was published already in 2003 [here.](https://www.irisa.fr/caps/projects/hipsor/publications/havege-tomacs.pdf)

I'm also glad that the HAVEGE algorithm is being further explored and examined - see the [CPU Jitter Random Number Generator.](https://www.chronox.de/jent.html)

I will keep maintaining HAVEGED - there are a couple of reasons for that:
* Most Linux installations are still running on the older kernel versions. 
* HAVEGED can also be used as the userspace RNG to generate random numbers. See `man -S8 haveged` for examples or try running `haveged -n 0 | pv > /dev/null`
* Last but not least, HAVEGED can be used as the RNG library. 
In any case, I will keep maintaining the HAVEGED project. The userspace application, as well as the haveged library, are not affected in any way by changes in the Linux kernel.

INTRODUCTION

Expand Down

0 comments on commit bfff89f

Please sign in to comment.