LibreSSL's PRNG is Unsafe on Linux

#1

Post by agwa » Mon, Jul 14, 2014, 11:11 PM UTC

LibreSSL's PRNG is Unsafe on Linux
agwa.name

Re: LibreSSL's PRNG is Unsafe on Linux

#2

Post by dobbsbob » Mon, Jul 14, 2014, 11:37 PM UTC

>First, LibreSSL should raise an error if it can't get a good source of entropy.

Comments for getentropy_linux.c explain this http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libcrypto/cryp...

We have very few options:

- Even syslog_r is unsafe to call at this low level, so there is no way to alert the user or program. - Cannot call abort() because some systems have unsafe corefiles.

Re: LibreSSL's PRNG is Unsafe on Linux

#3

Post by tormeh » Mon, Jul 14, 2014, 11:44 PM UTC

Can't the LibreSSL process just reseed whenever it is started? I guess forks don't actually copy the program counter so they'll have to go through main, right?

Re: LibreSSL's PRNG is Unsafe on Linux

#4

Post by agwa » Mon, Jul 14, 2014, 11:46 PM UTC

tormeh wrote: post #3

Can't the LibreSSL process just reseed whenever it is started? I guess forks don't actually copy the program counter so they'll have to go through main, right?

Nope, forks actually do copy the program counter.

Re: LibreSSL's PRNG is Unsafe on Linux

#5

Post by agwa » Mon, Jul 14, 2014, 11:46 PM UTC

dobbsbob wrote: post #2

>First, LibreSSL should raise an error if it can't get a good source of entropy. Comments for getentropy_linux.c explain this http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libcrypto/cryp... We have very few options: - Even syslog_r is unsafe to call at this low level, so there is no way to alert the user or program. - Cannot call abort() because some systems have unsafe corefiles.

The comments don't justify why going to the sketchy entropy is better than SIGKILLing the process, except with:

> This code path exists to bring light to the issue that Linux does not provide a failsafe API for entropy collection.

Trying to make a point about Linux doesn't seem like a very good reason to me.

Re: LibreSSL's PRNG is Unsafe on Linux

#6

Post by cjg_ » Mon, Jul 14, 2014, 11:51 PM UTC

tormeh wrote: post #3

Can't the LibreSSL process just reseed whenever it is started? I guess forks don't actually copy the program counter so they'll have to go through main, right?

It does copy the PC. Actually it just return from the fork call twice, one in the parent and one in the child, with different return values, the pid of the child to the parent and zero to the child.

See http://linux.die.net/man/2/fork for more details

Re: LibreSSL's PRNG is Unsafe on Linux

#7

Post by Raphael_Amiard » Mon, Jul 14, 2014, 11:58 PM UTC

tormeh wrote: post #3

Can't the LibreSSL process just reseed whenever it is started? I guess forks don't actually copy the program counter so they'll have to go through main, right?

> I guess forks don't actually copy the program counter so they'll have to go through main, right?

This is the way the fork syscall works on all Unices, the fork will start execution right after the fork system call.

Re: LibreSSL's PRNG is Unsafe on Linux

#8

Post by dobbsbob » Tue, Jul 15, 2014, 12:11 AM UTC

agwa wrote: post #5

dobbsbob wrote: post #2

>First, LibreSSL should raise an error if it can't get a good source of entropy. Comments for getentropy_linux.c explain this http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libcrypto/cryp... We have very few options: - Even syslog_r is unsafe to call at this low level, so there is no way to alert the user or program. - Cannot call abort() because some systems have unsafe corefiles.

The comments don't justify why going to the sketchy entropy is better than SIGKILLing the process, except with: > This code path exists to bring light to the issue that Linux does not provide a failsafe API for entropy collection. Trying to make a point about Linux doesn't seem like a very good reason to me.

The sketchy entropy is only an example, and is a work in progress. Comments read "XXX Should be replaced with a proper entropy measure." and is only called if entropy collection via /dev/urandom and sysctl have failed. If the sysctl method is depreciated it does raise(SIGKILL). They also rearranged getentroy_linux.c so that the main function with the important comments is at the top in hopes whoever is porting reads it.

If you were porting this to a GNU/Linux distro, you can read their list of options and raise (SIGKILL) resulting in silent termination if that's what your platform decided to do if both entropy methods fail, or test for it earlier and fail. Since they are BSD developers they leave it up to whoever is porting to decide.

Re: LibreSSL's PRNG is Unsafe on Linux

#9

Post by quotemstr » Tue, Jul 15, 2014, 12:15 AM UTC

dobbsbob wrote: post #2

>First, LibreSSL should raise an error if it can't get a good source of entropy. Comments for getentropy_linux.c explain this http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libcrypto/cryp... We have very few options: - Even syslog_r is unsafe to call at this low level, so there is no way to alert the user or program. - Cannot call abort() because some systems have unsafe corefiles.

> cannot call abort() because some systems have unsafe corefiles.

This logic seems specious. It's not the job of a library to solve that problem. If a system has crash dump collection configured insecurely, the problem is going to extend well past the SSL library.

> * This can fail if the process is inside a chroot or if file * descriptors are exhausted.

The right solution is to pre-open the file descriptor. SSL_library_init can fail. Do it there.

Re: LibreSSL's PRNG is Unsafe on Linux

#10

Post by syncsynchalt » Tue, Jul 15, 2014, 12:25 AM UTC

As a developer who's integrated with openssl several times (generally on Linux), I couldn't be more pleased with the results coming out of the libreSSL effort.

Even if we end up with a list of linux-specific gotchas (and I don't think we will), it is more a case of ten steps forward, one step back.