Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Random Numbers in Virtual Machines

rhelblog.redhat.com

Post reply on HN
Print view View original

1–10 of 18 posts

Re: Random Numbers in Virtual Machines

#3

Post by amitshah »

rdtsc wrote: post #2

> Red Hat Enterprise Virtualization starting version 3.5 also has exposed this feature. Anyone know what relationship that product has with oVirt ( http://www.ovirt.org ) ? I thought oVirt was kind of the upstream. So wouldn't they be adding this to oVirt as well.

Yes, oVirt is the upstream for RHEV, so adding the virtio-rng device to guests is a feature in oVirt 3.5 as well. I didn't mention Fedora or oVirt there but everything applies to upstreams as well.

Re: Random Numbers in Virtual Machines

#4

Post by web007 »

Entropy in VMs is hard to get, it's nice to see an "easy" way to access better system-level entropy. There are also a few utils that let you distribute entropy amongst your VMs[1], but getting everything directly from the system feels better from a security perspective.

I've been forced to use rng-tools and / or rng-usleep to get enough randomness in some Ubuntu VMs in the past. It's maddening to see SSL slowdowns for no good reason, and to have to trace it back to a blocking call to /dev/random for 8 lousy bytes.

[1] http://www.vanheusden.com/Linux/#security

Re: Random Numbers in Virtual Machines

#5

Post by rwmj »

rdtsc wrote: post #2

> Red Hat Enterprise Virtualization starting version 3.5 also has exposed this feature. Anyone know what relationship that product has with oVirt ( http://www.ovirt.org ) ? I thought oVirt was kind of the upstream. So wouldn't they be adding this to oVirt as well.

The original product was called Solid ICE by a company called Qumranet. Red Hat acquired Qumranet in 2008 and as we do with all acquisitions, we started to liberate the proprietary code. It became oVirt in about 2010, and parallel to that is the downstream (but also fully open source) RHEV management product.

Interesting fact: The original product was written in C# and ran only on Windows. It was translated into Java, largely automatically at first with manual tidy ups, so it could run on Linux or Windows servers. (Well there are some Python and other bits too)

http://lpeer.blogspot.co.uk/2010/04/switching-from-c-to-java...

http://lpeer.blogspot.co.uk/2010/05/casing-moving-target.htm...

Re: Random Numbers in Virtual Machines

#9

Post by amitshah »

ausjke wrote: post #7

It seems hwrng is mandatory otherwise /dev/random will block easily for virtio-rng.

The host has more sources that contribute to the kernel entropy pool: network and block IO are more than any individual VM.

Keep in mind, though, that just accessing /dev/urandom in the guest won't need too much input from the host.

However, having a hwrng is obviously the preferred option where there is need for a lot of entropy.

Re: Random Numbers in Virtual Machines

#10

Post by amitshah »

rwmj wrote: post #8
ausjke wrote: post #7

It seems hwrng is mandatory otherwise /dev/random will block easily for virtio-rng.

Modern Intel processors have an RDRAND instruction which (cue conspiracy theorists) is a hardware RNG. https://en.wikipedia.org/wiki/RdRand

However, it's RDSEED that needs to be used as input if we use the Intel instructions.

https://software.intel.com/en-us/blogs/2012/11/17/the-differ...

Edit to add: we can obviously pass on the RDRAND instruction directly to the VM, but that's less portable, because not all servers in a server farm may have that instruction available, limiting live migration capabilities.

So we can just pass on output from RDSEED into the host's /dev/random, and feed the VM /dev/random by default as described.

Post reply on HN