我正在进行随机数生成领域的研究,我需要演示著名的“P和Q”论文(here)中的“启动时间熵洞”。我们将同时备份同一个最小的Linux虚拟机的两个副本,并且我们希望它们的/dev/urandom值在启动过程的某个早期点是相同的。
但是,在引导过程中,我还不能足够早地阅读/dev/urandom来发现问题。我们需要在启动过程的早期。
如何获取/dev/urandom的最早可能值?我们可能需要修改内核,但我们在这方面的经验很少,需要一些指针。或者,如果有一个内核检测工具可以在不重新编译内核的情况下进行测试,那也太好了。
提前谢谢!
最佳答案
urandom
是通过设备驱动程序提供的,内核对该驱动程序所做的第一件事就是调用init
调用。
如果你看看这里:http://lxr.free-electrons.com/source/drivers/char/random.c#L1401
* Note that setup_arch() may call add_device_randomness()
* long before we get here. This allows seeding of the pools
* with some platform dependent data very early in the boot
* process. But it limits our options here. We must use
* statically allocated structures that already have all
* initializations complete at compile time. We should also
* take care not to overwrite the precious per platform data
* we were given.
*/
static int rand_initialize(void)
{
init_std_data(&input_pool);
init_std_data(&blocking_pool);
init_std_data(&nonblocking_pool);
return 0;
}
early_initcall(rand_initialize);
因此,这个驱动程序的
init
函数是rand_initialize
。但是请注意,注释指出setup_arch
可能在设备初始化之前调用add_device randomness()
。然而,调用该函数并不会增加任何实际的熵(它会向池中提供诸如MAC地址之类的信息,因此如果有两个完全相同的vm,那么就很好了)。从评论中: * add_device_randomness() is for adding data to the random pool that
* is likely to differ between two devices (or possibly even per boot).
* This would be things like MAC addresses or serial numbers, or the
* read-out of the RTC. This does *not* add any actual entropy to the
* pool, but it initializes the pool to different values for devices
* that might otherwise be identical and have very little entropy
* available to them (particularly common in the embedded world).
另外,请注意,熵池存储在关闭时,并在启动时通过in it脚本(在我的Ubuntu 14.04上,它位于
/etc/init.d/urandom
中)恢复,因此您可能希望在调用该脚本之前 53 (
54 date +%s.%N
55
56 # Load and then save $POOLBYTES bytes,
57 # which is the size of the entropy pool
58 if [ -f "$SAVEDFILE" ]
59 then
60 cat "$SAVEDFILE"
61 fi
62 # Redirect output of subshell (not individual commands)
63 # to cope with a misfeature in the FreeBSD (not Linux)
64 # /dev/random, where every superuser write/close causes
65 # an explicit reseed of the yarrow.
66 ) >/dev/urandom
或者类似的电话。