From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.1 (2015-04-28) on sa.local.altlinux.org X-Spam-Level: X-Spam-Status: No, score=-2.9 required=5.0 tests=ALL_TRUSTED,BAYES_00 autolearn=unavailable autolearn_force=no version=3.4.1 Date: Wed, 11 May 2022 09:01:49 +0300 From: Andrey Savchenko To: ALT Linux kernel packages development Message-Id: <20220511090149.3b8685dd2a745c127602617f@altlinux.org> In-Reply-To: References: <20220509142300.778629-1-vt@altlinux.org> <20220509190501.abdb47751fef8f7fdc58e6db@altlinux.org> X-Mailer: Sylpheed 3.7.0 (GTK+ 2.24.33; x86_64-alt-linux-gnu) Mime-Version: 1.0 Content-Type: multipart/signed; protocol="application/pgp-signature"; micalg="PGP-SHA512"; boundary="Signature=_Wed__11_May_2022_09_01_49_+0300_Q.vC7D_eKBr/y7YQ" Subject: Re: [d-kernel] [PATCH un-def/sisyphus] config: Enable seeding CRNG from CPU and bootleader X-BeenThere: devel-kernel@lists.altlinux.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: ALT Linux kernel packages development List-Id: ALT Linux kernel packages development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 11 May 2022 06:02:13 -0000 Archived-At: List-Archive: List-Post: --Signature=_Wed__11_May_2022_09_01_49_+0300_Q.vC7D_eKBr/y7YQ Content-Type: text/plain; charset=US-ASCII Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Wed, 11 May 2022 00:43:37 +0300 Vladimir D. Seleznev wrote: > On Mon, May 09, 2022 at 07:05:01PM +0300, Andrey Savchenko wrote: > > On Mon, 9 May 2022 17:23:00 +0300 Vitaly Chikunov wrote: > > > This can be disabled at boot time with: > > > random.trust_cpu=3Doff > > > random.trust_bootloader=3Doff > > >=20 > > > Signed-off-by: Vitaly Chikunov > > > --- > > > config | 4 ++-- > > > 1 file changed, 2 insertions(+), 2 deletions(-) > > >=20 > > > diff --git a/config b/config > > > index e529911fd5dc..5b817e945274 100644 > > > --- a/config > > > +++ b/config > > > @@ -4479,8 +4479,8 @@ CONFIG_XILLYBUS_CLASS=3Dm > > > CONFIG_XILLYBUS=3Dm > > > CONFIG_XILLYBUS_PCIE=3Dm > > > # CONFIG_XILLYUSB is not set > > > -# CONFIG_RANDOM_TRUST_CPU is not set > > > -# CONFIG_RANDOM_TRUST_BOOTLOADER is not set > > > +CONFIG_RANDOM_TRUST_CPU=3Dy > > > +CONFIG_RANDOM_TRUST_BOOTLOADER=3Dy > >=20 > > These sources are not trusted in most cases, so please avoid > > enabling them by default for everyone. >=20 > It's a very horrible world where you cannot trust to your CPU. The concept of trust is not binary. I do not trust RDRAND for sensitive materials. Even more so I do not trust UEFI platform generators. E.g. see: https://arstechnica.com/gadgets/2019/10/how-a-months-old-amd-microcode-bug-= destroyed-my-weekend/ https://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCVE-2020-0543 Welcome to the real world. Best regards, Andrew Savchenko --Signature=_Wed__11_May_2022_09_01_49_+0300_Q.vC7D_eKBr/y7YQ Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE63ZIHsdeM+1XgNer9lNaM7oe5I0FAmJ7UU0ACgkQ9lNaM7oe 5I1iWw//c2X44QB/URIierXo6L15dggwK/Jf9OCpmPivbbcvi9R32Vv4/PlB8bSp NQQTjl7mMeS/Bp3fv6Yg0QrX7B+lVrtGdIf+bdMgiIIxQB5FZO0rz+LNhiVR7TFk pyREMv3wzTFE+3pt9KXoRexbwylO+5tACt+c627vWvtEeaD1iTtEVo+B+8kJGPBN Pw5rJAnf0nXVO00T0W/EWcLEFPNLoVe8BK6qTGqFNeyKF7HDiljfOUa3FOJ1octK x6TyL1MLKSQ8lYJiO44k/uGKF29Usq6rgw0XqHCn5nd/xaNUx6DJXldM4aQUg5Lj NFe+tnKsn/T8cVUIJBWLL6kqOHLhwOcXKJhl0eur+RGcLSp/tjrOtsP3FQwBvwup jJ1D4qORn9+2aTa5WdTaWWGu2YxWMDWNSFg1S7PfMTxeisqjfESLdslPZzlvaPup RI2i/7GgsiZsD9BxPl6Ft88TMCDfcIU+SbGbd6XYvkpNFnPTPWV3RXHPygR5Pitl z3V1UIZz0IUbjzDLkzYkQMnN25c8zHfuHZ6xhOUCdOWvojMPm5b7qC0/DckE5zQf MOklHo125xNYar4qION7xLVnbHO68PutHCZztFrSy/r/mUXyh4fbPcptdgk1+ba4 NpiKn0UF58hrPUoHt0WlNz5c7k+RtdSNtlAIpN5BxX9lIt6G69U= =6J+S -----END PGP SIGNATURE----- --Signature=_Wed__11_May_2022_09_01_49_+0300_Q.vC7D_eKBr/y7YQ--