Collecting entropy from device_attach() times.

[Pawel Jakub Dawidek]

On Wed, Sep 19, 2012 at 07:30:52PM +0100, Jonathan Anderson wrote:
> > If all the times are more or less equally probable in this range […]
> 
> They're very unlikely to be equally probable. It would make sense to do some characterization of these times and their statistics: a highly non-uniform distribution would mean that we don't actually get many bits per attach.

I have times for ~2000 device_attach() calls when loading sound card
driver on totally idle system. If someone could take those and analyse
the distribution that would be great.

> > […] we have more
> > than 19 bits of entropy from this one call, but I reduced if to four
> > bits only, because there are devices that are much faster to attach.
> >  
> 
> Another reason for doing the above characterization is that, if a particular device_attach() really does provide 12 bits of uncertainty, it's a shame to drop eight of them on the floor.

Rights. That's why I've prepared another patch:

	http://people.freebsd.org/~pjd/patches/harvest_device_attach.2.patch

which effectively discards top ten bits, which means we expect 0.1% of
the attach time to be unpredictable (the attach time in most cases vary
by few percent, not sure yet how much of this variation is really
unpredictable).

-- 
Pawel Jakub Dawidek                       http://www.wheelsystems.com
FreeBSD committer                         http://www.FreeBSD.org
Am I Evil? Yes, I Am!                     http://tupytaj.pl
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 196 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-security/attachments/20120919/ba44693a/attachment.pgp