[Cryptech Tech] trng ready for play

[Joachim Strömbergson]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Aloha!

Fredrik Thulin wrote:
> I think you will agree if I state the problem like this: "as soon as
> the mixer requests entropy faster than the entropy providers can
> provide it, the mixer will loose sooner or later" - right?

Yes. And we can reduce the risk of this happening by adding FIFOs to
reduce problems caused by short term variance. Today I don't have them
since it adds complexity.

But if the mixer requests more data that an entropy source can provide
for arbitrarily long time, no FIFO will help.

But if we step back and look at the application, this means that
somebody is basically want to reseed the CSPRNG _all the time_ (every 16
bytes of 32-bit random data or so). And that must be considered a
misconfiguration and not realistic.


> I think there might be other recovery strategies worth considering,
> but I think it would be a good idea to start with something simple.

I'm sort of back to having a single timeout value in combination with an
alarm up the stack. And then add fifos in the entropy providers with
room enough to provide enough data to generate seed of the csprng. With
two entropy providers this comes down to 1024 kbit big fifos, i.e. a
fifo with 32 words depth. probably a bit overkill since the fifos will
be fed new data while the mixer pulls. But this should make the mixer
inpud data creating always complete in 2x32xn cycles (n = 2 or so). 2-3
microseconds or so.

- -- 
Med vänlig hälsning, Yours

Joachim Strömbergson - Alltid i harmonisk svängning.
========================================================================
 Joachim Strömbergson          Secworks AB          joachim at secworks.se
========================================================================
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.22 (Darwin)
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQIcBAEBCAAGBQJUP87LAAoJEF3cfFQkIuyNywoP/1Kqu4rtgv0CIXoq1yvlnnKH
lVDbxiN2En9JCl3K3B5N0Sqft3LvX0XzwOjHuAINO39563DJJBpswdlfwmBV3UjB
6QiBbWOwOigNJHH0ygNBWABoxzjl2CXGYFquoH9Gd4+VV064np3fdwOSgTJF4fQx
jaa7GC8H6MzAosRTODcVRApaxvkJGnr0R3pK3QC2uVDSalB1MdiRMRC+uRD77lw+
dHh6oKjGvEF4AHjm1pnKPboIbXGSlZa8K5hY43YhFW+9LjN6yP4840nMu2Otsgwg
cLHdETluWnQNijfpWJUWTMHRSHZwCoZ4+GBtl0QndsJ74G1ESiM0kHgJaO94ySAC
pjtSOWMyNBZugKdzAHrkruaKVDqFwFjX6UfbItTxBddI6bs8uZCKqje6gKiqztc1
VmWsECP2AFd21IpzCAXirN/S7vqIjLUJLjbYuuiNvA9kaSjLqKiuaZOK4iVQSnDN
7VboUuaD++Db3p7KjUpRCFduITfFqMQvIQRWrZ+rq9qKWSl4tfEfNMxvEWZwbuPe
7Lz4RA/OFBQW4GOK8AG/AxF1GQPIewnqJkCku9kz8b8sM7cTHAe0wYv8YThKXkgt
jL0Yke8w1VXcF80x9VKwW0MmieywnPqjyusJkPyQWDZ0mc4Mmoj/iqrAun5RQcol
kIBpPaW9v0qh5x5AhQci
=t5WA
-----END PGP SIGNATURE-----