Really Fixing Getrandom()
lwn.net
lwn.net
I love this story, as a complete unrelated kernel commit that reduced the amount of file I/O, caused the kernel to not generate enough entropy at boot, and in consequence, made the system unbootable.
I'm OK with this as a starting point. If a jitter entropy system allow us to get pass this logjam, let's do it. At least for the x86 architecture, it will be security through obscurity. And if the alternative is potentially failing where the adversary can attack the CRNG, it's my preference. It's certainly better than nothing, in that in that very worst case, "security through obscurity" is better than "don't block, because blocking is always worse than an guessable value being returned through getrandom(0)". And so if these are the only two options, I'm certainly going to choose the former.
That being said, I'm still very worried that people with deep access to the implementation details of a CPU might be able to reverse engineer what a jitter entropy scheme produces. For that reason, I'd very much like to see someone do an analysis of how well these jitter schemes work on an open, simple architecture such as an RISC-V iplementation (you know, the ones that were so simplistic and didn't have any speculation so they weren't vulnerable to Specture/Meltdown). If jitter approaches turn out not to work that well on RISC-V, perhaps that will be a goad for future RISC-V chips to include the crypto extension to their ISA.
In the long term (not in time for the 5.4 merge window), I'm convinced that we should be trying as many ways of getting entropy as possible. If we're using UEFI, we should be trying to get it from UEFI's secure random number generator; if there is a TPM, we should be trying to get random numbers from the RPM, and mix them in, and so on.
After all, the reason why lived with getrandom(0) blocking for five years was because for the vast majority of x86 platforms, it simply wasn't problem in practice. We need to get back to that place where in practice, we've harvested as much uncertainty from hardware as possible, so most folks are comfortable that attacking the CRNG is no longer the simplest way to crack system security.
(The above is a lightly edited almagamation of https://lore.kernel.org/r/20190930033706.GD4994@mit.edu and https://lore.kernel.org/r/20190930131639.GF4994@mit.edu)
It seems that this fight has continued for so long because both possible answers are valid here, depending on the exact use case of the system as a whole(+)? Have we got an interface which lets you properly specify the paranoia vs. best-effort choice yet?
(+) e.g. the SSH server running on your lightbulb may accept that it's not exposed to the internet and therefore not subject to targeted attack, but it's really inconvenient to sit in the dark, so the security-availability tradeoff is worth it.
> most folks are comfortable that attacking the CRNG is no longer the simplest way to crack system security.
Was it ever? It seems that phishing the admins has always been the easiest way.
As such, is there an option to configure OpenSSH such that it has a fixed authorized_keys, and does the authentication handshake in the opposite order: first establishing that it can talk to the client by decrypting the messages the client is sending; and then parsing the client’s auth commands from said decrypted stream, where one SSH AUTH message might be “auth me using the very key we’re conversing over.”
If there is, I’m surprised IoT devices don’t go for it. If there isn’t... why not?
At least you can override the default functionality with your own by utilizing the "authorized keys command". It basically allows you to create your own authorization scheme instead of the default "key in file means access granted"
I'm not completely certain that it's impossible to make this secure, but it's definitely very easy for it to get done in a way that's insecure.
It's absolutely critical in SSH that we end up with a unique session ID which will be the output of a cryptographic hash function (these days maybe SHA-256) but obviously the input to that function must be secret. Everything in the higher level parts of SSH assumes that there is a secret unique session ID. The session ID stays the same for the lifetime of a connection, although you can run key agreement itself again if the connection is long-lived or moves a lot of data so that it's unwise to keep using the same symmetric keys.
If you do any variant of DH obviously this session ID is the end result of the first DH key agreement process and so it'll be different every time because you're using random numbers.
But if you want to add a "fixed asymetric keys" mode you're going to need to agree a secret session ID for each new connection... somehow.
At some cost you could pick at random and send it from one party to the other, but then we're exactly back where we started about how we're assuming we have a good source of entropy.
If we just pick any fixed value it might as well be 0000 0000 0000 0000 and so on then obviously a bad guy can break everything and we should have just used telnet.
As far as whether it might be simpler to attack the CRNG, please see https://factorable.net/ where a researcher found that at one point 10% of all publically reachable internet sites had insecure SSH keys due to a weaknesses in Linux's random number generator. Granted, these were mostly end user's home routers (many of which had open ssh ports in the day), and most servers on x86 wouldn't have been nearly as vulnerable. But the "Mining your p's and q's" paper is one of the key reasons why I remain very conservative about Linus's random driver to this day. I got the pre-publication notification on July 3rd, and I spent all day on July 4th on top of the Boston Science Museum's parking garage with a laptop, frantically trying to come up with a good fix to the problem while my very patient and accomodating girlfriend and I were waiting for the Boston Pops Fireworks show in the evening.... This is not the kind of thing one wants to do again!
Details from the bug I filed (https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/17103...):
src/util/virrandom.c:virRandomOnceInit seeds the random number generator using this formula: unsigned int seed = time(NULL) ^ getpid();
This seems to be a popular method after a quick google but it's easy to see how this can be problematic. The time is only in seconds, and during boot of a relatively identical system these numbers are both likely to be relatively similar across multiple systems which is quite likely in cloud-like environments. Secondly, by using bitwise OR only a small difference is created and if the 1st or 2nd MSB of the pid or time are 0 then it would be easy to have colliding values.
Though problematic from basic logic, I also tested this with a small test program trying 67,921 unique combinations of time() and pid() which produced only 5,693 random seeds using PID range 6799-6810 and time() range 1502484340 to 1502489999.
During the actual incident in question, the 4 systems were all booted within 1-2 seconds of each other. We can see from dmesg that the two systems that generated the same MAC did in fact boot during the same second and the other two did not
> Digging through the code revealed 8 bytes worth of key fairly quickly, but the other 8 bytes were less obvious. I finally figured out that 4 more bytes were the value of another Bluetooth variable which could be simply read out by a client. The final 4 bytes were more confusing, because all the evidence made no sense. It looked like it came from passing the scooter serial number to atoi(), which converts an ASCII representation of a number to an integer. But this seemed wrong, because atoi() stops at the first non-numeric value and the scooter serial numbers all started with a letter[2]. It turned out that I was overthinking it and for the vast majority of scooters in the fleet, this section of the key was always "0".
https://people.eecs.berkeley.edu/~daw/papers/ddj-netscape.ht...
Netscape was using a related method for seeing the PRNG to the one you mention, which was still a small enough space of possible seed values that when the resulting values were using in cryptography, an attacker could brute-force the seed.
http://www.chronox.de/jent/doc/CPU-Jitter-NPTRNG.html#toc-Ap...
https://pdfs.semanticscholar.org/af73/17c970fd416646b2e46659...
See 2nd point here: https://www.2uo.de/myths-about-urandom/
Neither one of those is usable for key generation. urandom may give you repeatable data if the system hasn't seeded itself yet. random may block on accounting that most experts find problematic.
getrandom() finally provided the right semantics of only blocking when the system isn't seeded, and without a filesystem/device node dependency; however changes in startup software, including filesystem improvements have resulted in shortened boot sequences and less entropy gathered. In some cases, systems were blocked waiting on entropy before any (non human interfaced) entropy sources were enabled.
> but mixing entropy from the hardware with other sources is considered to be safe by most, even if the hardware generator is somehow suspect.
To be clear, it's a property of bitwise xor that it preserves entropy. If you xor a random bit with 1 you still have a random bit.
A property of bitwise xoring random variable `x` with a constant (or otherwise non-random but independent) value is that the entropy of `x` is preserved in the result.
0 is as random a number as 529890873740477 is.
How safe is it to use CPU jitter in a virtual machine?
Like HN users will gladly spend hours discussing the merits of various random number generation schemes, why that Intel HWRNG is probably backdoored and we should all be very afraid, all the while running their micro-services on the cloud where their entropy is literally spoon-fed from the hypervisor. SMC call into code-you-can't-see and back comes pure entropy (trust us)!
This is well outside of my wheelhouse, so please pardon a naive inquiry.
Whether tsc clock and timer clock are linked or not is completely irrelevant, since the timer clock is only used to 1) credit entropy 2) possibly introduce additional jitter. The value of TSC when the timer interrupt runs is not used as entropy at all so even if that were 100% predictable, it doesn't matter.
It only matters that you do have jitter (between calls to schedule() and random_get_entropy()), and I have a hard time imagining a modern system with a high-res TSC where calling schedule() with active timers in a loop (with branches) would not have any jitter at all. You probably have way more entropy than one bit per jiffy; I think the counter is very conservative.
Notice that while entropy is credited only once per tick, actual TSC values are mixed into the entropy pool on every iteration of the loop that calls schedule().
But of course this doesn't solve the problem of newer kernels on existing installations with no such stored seed and that don't pass command line argument telling the kernel where to store the seed.
Read the previous https://news.ycombinator.com/item?id=21114524 story for more on the problem space and why what you wrote is not considered enough.
This needs to be invalidated before numbers dependent on the seed are used, else you risk attacks where you get someone to generate the same random numbers on consecutive boots.
In turn, if you crash during bootup at the wrong time, you're left without a seed.
There is no problem with a crash assuming that the seed write mechanism is crash-safe (which is achievable with block storage, but indeed I'm not sure whether firmware is properly designed and implemented).
does anybody here know a portable, easy to use, and high quality, deterministic random number generator? It is a requirement that you must get the exactly the same sequence of pseudo-random numbers on any architecture (depending on a user-settable seed).
I use a hand-crafted (two-line) linear congruential generator, but always feel a bit uneasy about that.
If you use the same symmetric key and nonce, the output bit stream should be the same every time.
This is how OpenBSD's arc4random(3) started out: using the output of RC4 and stirring the entropy pool regularly to ensure forward security. (They've since switched to ChaCha20.)
* https://man.openbsd.org/arc4random.3
Remove the stirring and you've got deterministic output. Security comes from the entropy of the initial conditions.
I use a 64 bit one and a 128 bit one for all sorts of work.
These are not crypto, so don't use them for that. For non-crypto I have seen no better PRNG than these (and I've followed and written on this space for a long time).
Code available on github.
Also, I'm answering a question by someone that looks like they want precisely this type of PRNG. There is no need to make a mess with CPRNGs.
You would do something like rng1 = AES(seed); rng2 = AES(rng1); rng3 = AES(rng2);
For cryptographic applications what you want is as previously noted just some arbitrary secure stream function (with block cipher in OFB or CTR mode being particularly convenient way to obtain such cipher). Bear in mind that for cryptographic applications it is often important whether the state can be determined by observing the output and whether the state can be rewound back (which then necessitates choosing stream cipher that satisfies these requirements or using more complex construction. Most notably block ciphers in CTR/OFB mode does not satisfy this and ChaCha/Salsa also does not as it is essentially block cipher in CTR mode). Interesting modern construction would involve Keccak-style sponge functions, which are kind of universal cryptographic primitive that is usable as hash, MAC and PRNG/stream cipher all at once depending on mode of operation.
For monte-carlo simulations you want something that is reasonably fast and has large state space. Mersenne Twister is common choice, although XorShift is significantly faster and usually has state space that is large enought.
For randomized distributed simulations (read: lock-step realtime multiplayer games) you don't care about the output quality of the output that much and LCG tends to be sufficient, althought also in this case XorShift would be probably better as it has comparable performance and significantly better output quality.
All the mentioned algorithms are by definition deterministic and discounting implementation errors platform independent.
We've dealt with this in Rust—people love to write Monte Carlo simulations as language benchmarks, and Rust used to get dinged for preferring CSRNGs.
What kind of speed needs are we talking about? With AES-NI in most modern CPUs you can get many MB/s or GB/s.
* https://calomel.org/aesni_ssl_performance.html
(I don't do MC, so have no idea.)
In the case of brute force Monte Carlo path tracing, the speed of the RNG is important, because you have dozens or hundreds of rays per pixel, each with multiple bounces, and every bounce samples from your RNG. When your render times are 6 hours per frame to begin with, you really don't want to mess around.
Yes, it is possible but its difficult to do it right. I ran into at least 3 or 4 "roadblocks" while designing this algorithm, fortunately I managed to get through all of them.
I've got an unrolled dual-stream going at 37.1 GBps on Threadripper 1950x (which has 2x AES pipelines). ~29.2 GBps for more "typical" usage (but still impractical).
The issue with this is that random-bits of this speed are almost useless. A division or modulus operation takes 80-cycles (~20 nanoseconds) so as soon as you do "rand() % 6" (assuming you wanted a 6-sided dice roll), you've completely wreaked the bit-generator. A branch-misprediction is like 15-cycles, so that singular if-statement in your code that uses the RNG-number would be 5x slower than the generator itself.
Its fast, but I don't know how practical it is. There's no practical way to use all of these random bits that I'm aware of.
I did get a bit-compatible POWER9 version running by the way. So its portable across systems (at least, systems with an AES-encoder. ARM, Power9, and 2010-era x86.). Rasp. Pi doesn't have a CPU-AES engine however (its outside of the core), so Rasp. Pi can't use this methodology.
--------------
If I were to actually push forward with this project more, I'd need to study on whole-program optimization, so that the (rarely used) XMM registers can be pragmatically used in a lot of code. The entirety of this RNG fits inside a single XMM register, so it'd benefit grossly from whole-program optimization.
The XMM-data should also be fed into SIMD somehow, some kind of engine into ispc or OpenMP SIMD code. A bunch of raw-bits coming in through assembly commands is somewhat impractical, no matter how you look at it.
Dan Lemire informed me of an amazing algorithm (that does work with AES XMM registers) that creates uniform random numbers out of a few multiply instructions. So I can get XMM-registers full of arbitrary integers with very low bias. (ex: numbers between 0 and 100) out of the bitstream.
I also managed to convert the numbers into single-precision floats and double-precision floats between 0 and 1.0 uniformly.
Still, this only really seems practical if you have SIMD-code that actually consumes all of these bits. Converting from XMM-registers into RAX registers has quite a bit of slowdown.
I don't think the typical simulation code is actually limited by the speed of RNGs at all.
Ok, let's say we're rendering at 8K (32 megapixels), 200 rays per pixel, 20 bounces per ray. And rendering that frame takes 6 hours. How many (mega)bytes of random data do we need per second?
; (32*10^6) * 200 * 20 / (6*60*60) / (1024^2)
~5.65140335648148148148
And here I can pull an order of magnitude more and then some (180 megabytes/s) via /dev/urandom on OpenBSD (i.e. Chacha20, no hardware accel), using a single core of a few-years-old fanless mini PC (some Intel Celeron with "U" postfix).
I generally don't buy the argument that your PRNG needs to be super duper fast, because usually the simulation is doing much more than just generating random data, and all that work is so much more expensive than even a relatively expensive CSPRNG. At least my ray tracers are. Generating rays is actually trivial compared to traversing, intersecting and shading the scene.. goodness gracious if I need to do actual texture & normal map lookups at a high resolution, so many cache misses :(
That said, a simple and fast PRNG with little internal state can make life easier if you want reproducibility.. and it might be easier to build a reproducible simulation if your RNG gives exactly one word the size you need, instead of requiring you to generate a big block (and then extract things out of it somehow). This is especially the case with threaded sims. So yeah.
But in this case, I wouldn't be looking at something like XorShift, I'd be looking at a random map that allows me to use (e.g.) the pixel's coordinates and a frame & bounce counter as the input and get matching (constant) output. Now it no longer matters which thread renders which pixel and when, the result will be all the same. It's not hard to build such functions, but they will be slower than XorShift if you want comparable quality. Speed should be no problem though.
The GP is giving a real-life example (people having complained about something being too slow compared to xorshift) and yet you try to do the math to prove it couldn't happen…
People having complained is not a real-life example of an actual performance issue. Until otherwise proven, it's a real-life example of someone complaining about some microbenchmark that, based on my real life experience, would be completely irrelevant if they actually developed their real world problem-solving program which totally shifts the bottleneck to something that actually matters.
Alternatively, it's a real-life example of poor implementation or usage, and not necessarily poor performance of the underlying primitive. This also happens a lot. "Foo is slow!" is true for a lot of things if you use them wrong. Maybe it's simply the user's ignorance, or maybe the API isn't well designed to support their case. Maybe it's poor documentation.
Also, this is a technical forum. There's absolutely nothing wrong with people doing back of the envelope calculations to analyze the scale of a problem. If more people did that while pointing at real examples with concrete numbers, maybe we'd actually know things instead of just relying on hearsay and religion. Whatever, it's a cargo cult industry.
Here's the good part: if someone who knows better comes along, they find those numbers and can tell us why we're wrong. Otherwise, let's just take everything on faith?
It's amazing how often people (like you, who haven't contributed anything except noise to the discussion) just don't want to understand a problem and if someone comes along trying to understand it and do the math, they're called a lunatic.
And this is why some of the code I get to work on is so terrible, people are wasting time and complicating code to micro-optimize things that are completely irrelevant (a conclusion one could come to either by a ballpark-estimate or a quick profile), while massive bottlenecks sit unattended.
Counter (0, 1, 2, 3, 4...) -> Multiply Const1 -> Bit-reverse -> XOR Const2 -> Multiply Const3 has been my PRNG for GPUs.
Const1 and Const3 need to be odd (bottom bit == 1). Const2 can be fully random. All three values can come from /dev/urandom with pretty good results with some preliminary testing. I haven't figured out a good methodology from selecting Const1 or Const3 aside from the bottom-bit == 1 and random (If I had more time, I'd probably work on it...)
---------
The "counter" is 64-bits and allocated per-thread. Assume 2^14 bits for 16384 GPU-threads, each GPU-thread then has 50-bits of values.
64-bit integer multiply is slow however. 32-bit multiply would be faster for most GPUs. But also in my experience, GPUs are almost always memory-constrained, not compute-constrained. So you probably can do fine with 64-bit integer multiply.
If you really need to stick with 32-bit integers, then make Const1 and Const3 per-thread specific. That gives a unique sequence of 32-bit numbers per thread, but a 32-bit cycle is inevitable every 4-billion numbers with only 32-bits of state.
If what you want is just to add some uniform, seemingly random behavior to something (e.g. a game, generate some noise, whatever), I've used the Wolfenstein3D's FizzleFade effect algorithm [0] in the past.
It's boringly easy and works like a charm.
Depending on what random numbers are used for between seeding and writing the updated seed, that could range from harmless to disastrous.
With some care in how things are ordered during system startup, it could probably be made safe.
* https://www.freebsd.org/cgi/man.cgi?loader.conf(5) (see "entropy_cache_load")
When the system is brought down cleanly (init 0 or 6) a seed file is saved. Also, when the system is started up, a seed file is created in case there's a crash. OpenBSD's rc(8):
# Push the old seed into the kernel, create a future seed and create a seed
# file for the boot-loader.
random_seed() {
dd if=/var/db/host.random of=/dev/random bs=65536 count=1 status=none
chmod 600 /var/db/host.random
dd if=/dev/random of=/var/db/host.random bs=65536 count=1 status=none
dd if=/dev/random of=/etc/random.seed bs=512 count=1 status=none
chmod 600 /etc/random.seed
}
FreeBSD also has a cron job that saves 4KB of entropy every 11 minutes in a rotating series of files:
* https://svnweb.freebsd.org/base/head/libexec/save-entropy/
* https://svnweb.freebsd.org/base/head/libexec/rc/rc.d/random
The problem is that not all hypervisors provide the device by default. I use libvirt KVM/QEMU and the default template doesn't include it, but you can add it. AWS EC2 doesn't provide it, though it doesn't provide any virtio devices. Parallels Desktop 15 doesn't support virtio-rng, either
OTOH, OpenBSD's VMD not only supports it but I think it's enabled by default. (I see it in the source code. I can't find a way to enable/disable it, but the publicly posted dmesg dumps seem to always show it as found when an OpenBSD guest boots.)
Of course, most VMs are x86_64-based using hardware extensions and likely using CPUs providing rdrand. But hypervisors really should provide the virtio-rng device default, perhaps even unconditionally as OpenBSD apparently does.
Yes, my VMD virtual machines have it with no configuration necessary.
pvbus0 at mainbus0: OpenBSD
pci0 at mainbus0 bus 0
virtio0 at pci0 dev 1 function 0 "Qumranet Virtio RNG" rev 0x00
viornd0 at virtio0
The file is created (a) when the system is shutdown cleanly, but also (b) when the system comes up cleanly in case of a crash later on.
That's why a working getrandom is so important.