Re: Seeding the Linux RNG at first boot

[Ludovic Courtès]

Leo Famulari <address@hidden> skribis:

> On Wed, Dec 06, 2017 at 12:11:36AM +0100, Marius Bakke wrote:
>> FWIW if you control the hypervisor, you can send something along the
>> lines of:
>> 
>> qemu -device virtio-rng-pci,bus=pci.0,addr=0x1e,max-bytes=1024,period=1000
>> 
>> to feed the guest with entropy from the host through virtio, up to 1kB/s.
>
> Exactly, this is along the lines of what I'm thinking for `guix system
> vm`.
>
> On the guest side, we would extend urandom-seed-service to also draw on
> /dev/hwrng, which is where virtio-rng-pci makes the data from the host
> available.

Maybe ‘virtualized-operating-system’ in (gnu system vm) could
automatically customize ‘rngd-service-type’ (or add it)?

> Currently there is the rngd-service-type, but that is doing something
> slightly different. Using /dev/hwrng to seed urandom could be done
> whenever it's enabled in the kernel.
>
> I have an idea for another improvement: to add an argument like
> "--entropy-seed=" to `guix system` that could place the value in
> '/var/lib/random-seed', where it would be used on first boot.

We could do that, though I very much prefer the idea of a “backdoor” à
la virtio-rng-pci, because it allows to stick to bit-reproducible images
(well, they’re not bit-reproducible yet I suppose, but let’s not add to
it.)

WDYT?

Ludo’.