random(4) plugin infrastructure for mulitple RNG in a modular fashion

[Tim Kientzle]

On Aug 18, 2013, at 10:20 AM, Mark R V Murray wrote:

>> Users could compile the null mixer into the kernel
>> and load a single HW RNG driver to have precise
>> control over /dev/random.  Interrupt harvesting would
>> be the lowest-quality source as a fall back.
> 
> There are lots of harvest points in the kernel. Why not
> take the lot?

I think everyone agrees that the GENERIC kernel
should use Yarrow or Fortuna to mix the available
entropy sources.

But clearly some people really want to be able to
force /dev/random to be the unconditioned output
of a particular HW RNG.  I don't know if this is a
good idea or not, but clearly there are people who
want this.

I think my proposed "null mixer" is a reasonably simple
way to allow that.  (Should probably call it a "passthrough
mixer" rather than "null.")

And I think it does so in a way that doesn't introduce
horrible failure modes.

>> In particular, this has a reasonable failure mode if
>> someone built a kernel with only a single HW entropy
>> source and the null mixer:
>> * On hardware with that source, they would get
>>    full-speed HW entropy.
> 
> OK. Works for me. This is me accepting a point and
> changing my stance.
> 
> This will need to be written.

Yes, the "passthrough mixer" would need to be written
as an alternative to Yarrow or Fortuna.

My key claims:
  * Entropy mixers such as Yarrow, Fortuna, or
     passthrough are different from entropy sources.
     Mixers specify how /dev/random is generated from
     available entropy.

  * It makes sense to only allow one mixer in a particular
     kernel.  That could be done via kernel options; I suppose
     it could be done as device modules but only one of
     them can actually own /dev/random.

  * It makes sense to access HW RNGs via device modules
    and to allow any number of them to be loaded and active
    at the same time.

The above provides a good answer for GENERIC
(Yarrow/Fortuna mixing all available entropy).

The above also allows people to build custom kernels
that connect a single entropy source to /dev/random
without having horrible failure modes.

>> * On hardware without that source, they would get
>>    the old blocking /dev/random that we had before
>>    Yarrow, the one that used only interrupt harvesting.
> 
> Disagree. The fallback should be Yarrow/Fortuna. Both
> do a better job with the same input.

I agree Yarrow/Fortuna are better.

But some people really want to only have their preferred
HW RNG and are going to demand that Yarrow/Fortuna
not be compiled in if they don't need it.  For example, some
embedded processors are starting to get HW crypto; a
passthrough mixer plus HW RNG could be significant
code savings compared to Yarrow or Fortuna.

I am NOT claiming the old blocking /dev/random is
"good"; just that it is not an entirely unacceptable failure
mode for badly mismatched kernel/hardware combinations.
Keep in mind such mismatches may happen accidentally:
add-on HW RNG cards can fail.

Tim