On Pá, 2014-04-25 at 14:33 +0000, fweimer(a)fedoraproject.org wrote:
Repository :
http://git.fedorahosted.org/git/?p=secure-coding.git
On branch : master
>---------------------------------------------------------------
commit 564ffc80149307d0a99724e2689ed3a8816513bf
Author: Florian Weimer <fweimer(a)redhat.com>
Date: Fri Apr 25 13:47:22 2014 +0200
sect-Defensive_Coding-TLS-OpenSSL: Mention "openssl genrsa" entropy issue
>---------------------------------------------------------------
defensive-coding/en-US/Features-TLS.xml | 9 +++++++++
1 files changed, 9 insertions(+), 0 deletions(-)
diff --git a/defensive-coding/en-US/Features-TLS.xml
b/defensive-coding/en-US/Features-TLS.xml
index 936910d..f4da007 100644
--- a/defensive-coding/en-US/Features-TLS.xml
+++ b/defensive-coding/en-US/Features-TLS.xml
@@ -186,6 +186,15 @@
verify</command> result in an exit status of zero.
</para>
<para>
+ OpenSSL command-line commands, such as <command>openssl
+ genrsa</command>, do not ensure that physical entropy is used
+ for key generation—they obtain entropy from
+ <filename>/dev/urandom</filename> and other sources, but not
+ from <filename>/dev/random</filename>. Keys generated by
+ these tools should not be used in high-value, critical
+ functions.
+ </para>
This one is quite questionable. We should not make impression
that /dev/urandom is insecure apart from situations where the kernel is
not seeded with entropy. Of course in case of diskless machines the
entropy seeding of the kernel entropy pool might be very scarce and just
after boot the entropy in the pool might be insufficient. But once the
kernel pool is properly seeded once the generated pseudorandom numbers
are secure. I would say that keys for high-value, critical functions
(but how are these really defined) should not be generated on virtual
machines or diskless routers or similar machines where the entropy
sources are limited.
--
Tomas Mraz
No matter how far down the wrong road you've gone, turn back.
Turkish proverb
(You'll never know whether the road is wrong though.)