2
$\begingroup$

How could you improve entropy on a router running Linux kernel 2.6.x without TRNG or RTC ?

$\endgroup$
  • $\begingroup$ You can xor traffic that passes through the router into the entropy pool. You can never weaken entropy by xoring it with anything, and even if it's a weak source of entropy it's still one more thing that must be anticipated by an attacker. $\endgroup$ – user10653 May 6 '17 at 16:57
  • 1
    $\begingroup$ @dingrite I strongly recommend against xoring. If you use a proper PRNG, it'll have an entropy injection interface, use it. You can weaken entropy by xoring if what you xor is derived from the entropy pool. Not if it's derived through a proper PRNG, but if you have a PRNG, use its entropy injection interface... $\endgroup$ – Gilles 'SO- stop being evil' May 6 '17 at 19:38
  • $\begingroup$ @Gilles xoring entropy with itself obviously wipes it out, do you have a source that explains how xoring it with a hash of itself impacts it negatively? afaik, all those entropy mixers fundamentally utilize hashing. $\endgroup$ – user10653 May 7 '17 at 19:06
  • $\begingroup$ @dingrite The problem is doing it right. If you throw something together without understanding it, there's a risk of doing it wrong. Doing state := state xor f(state) will not weaken the entropy for most slapdash f, so the risk is relatively low, but it's still better not to take the risk at all and use the PRNG's interface. Recommending that people do something ad hoc is not a good idea. $\endgroup$ – Gilles 'SO- stop being evil' May 7 '17 at 20:46
  • $\begingroup$ Ironically, one thing to do (for kernel 2.6, not for newer kernels) is to keep the entropy pool intentionally low by periodically sending /dev/random to /dev/null. That causes the kernel to disable its "trickle threshold" and work harder at collecting entropy. Otherwise, it only collects one in every 4096 events. $\endgroup$ – forest Mar 25 '19 at 7:53
3
$\begingroup$

You don't need to continually feed entropy into the system for security, so long as the OS random number generator was strongly seeded once.

If you're unsure about the seeding history of the device, add some entropy. Take a photo of the sky with your mobile phone. Upload to your router and pipe it into /dev/random. That's all the entropy you'll ever need on that particular device.

Seriously, there is so much nonsense surrounding entropy gathering out there it's almost funny. The Linux manual page for /dev/random is the cause of much of this pseudoscience; it is simply wrong. The "entropy counters" provided by the kernel are ad-hoc estimates which are meaningless from a security perspective.

You can't "use up" or "lose" entropy on a modern OS. As long as your entropy is used only to seed a CSPRNG (which is true in even very old Linux), 256 bits of entropy is enough for every possible use case. If you don't believe that 256 bits is enough to generate a infinite stream of secure randomness, you'd better stop using AES in counter mode for encryption as well.

$\endgroup$
  • $\begingroup$ Comments are not for extended discussion; this conversation has been moved to chat. $\endgroup$ – e-sushi May 6 '17 at 17:39
  • 1
    $\begingroup$ There's one important step missing: reading back and updating the entropy at each boot. A typical router firmware doesn't write to its flash memory except on a configuration change, so it boots with no entropy. $\endgroup$ – Gilles 'SO- stop being evil' May 6 '17 at 19:36
  • $\begingroup$ What about the use of haveged ? $\endgroup$ – uihdff May 8 '17 at 12:03
  • $\begingroup$ @uihdff the question says there is no real time clock, so I guess no high resolution timer is available either? $\endgroup$ – rmalayter May 8 '17 at 12:47
  • $\begingroup$ @rmalayter - The router is an Asus RT-AC88U so I would guess that it does not. $\endgroup$ – uihdff May 8 '17 at 16:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.