[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Xen-devel] [RFC] Hypervisor RNG and enumeration

On Thu, 2014-10-30 at 07:45 -0700, Andy Lutomirski wrote:
> > Xen does not have a continual source of entropy and the only feasible
> > way is for the toolstack to provide each guest with a fixed size pool of
> > random data during guest creation.
> >
> Xen could seed a very simple per-guest DRBG at guest startup and then
> let the rdmsr call read from it.

I think I'm a bit confused by the intended scope of this facility. The
original spec said:
        Note that the CommonHV RNG is not intended to replace stronger, 
        paravirtual random number generator interfaces.  It is intended 
        for seeding guest RNGs early in boot.
Which to me reads that the guest should be using this facility to seed
it's own simple DRBG on boot (with some finite amount of seed data from
the hv) and then using that until it can switch to something better. Is
that not the intention?

I think it's important to nail down the intended scope of this
interface, since it has quite an impact on what would be considered a
reasonable common design. 

Post boot I would as you say expect most OSes to switch over to
something more capable, not continue to rely on this facility for the


Xen-devel mailing list



Lists.xenproject.org is hosted with RackSpace, monitoring our
servers 24x7x365 and backed by RackSpace's Fanatical Support®.