Inside the Linux Kernel Random Number Generator
summary
The Linux RNG replaces fragile LFSR math with a cryptographic pipeline using blake2s for mixing and ChaCha20 per-CPU streams, avoiding global locks for large performance wins. Vulnerabilities are demonstrated by modeling the old LFSR in pyz3 and solving it with Boolector, showing linear invertibility and small cycles. The overhaul is incremental: 147 commits shrink random.c to ~900 lines with ~500 lines of comments. Boot seeding uses bootloader seeds, RDCOUNTER jitter, and HW RNGs; initialization targets 256 bits, with the first 128 bits applied immediately and the next 128 buffered; reseed cadence is ~1 minute.
AI-written summary · about
chapters (14)
- 0:00History of random.c
- 2:54Old vs. New Approaches
- 7:16Incremental modernization
- 8:51Entropy collection
- 11:41Entropy expansion
- 14:01Entropy sources
- 18:51Interrupt timing
- 21:19Fast mixing function
- 23:34Jitter and hardware RNG
- 27:39Entropy estimation
- 31:42Threat models
- 36:44Reseeding policy
- 38:45User space interfaces
- 42:43Q&A
related talks
01h 30mRandom
57mAttacking the Linux PRNG on Android
24mRISC-V True Random Number Generation: Probably Too Important to be Left to Chance
54mAnalyzing & Breaking QNX Exploit Mitigations and PRNGs For Embedded Systems
41mCybersecurity and random number generators
28mRandomness in Python: Controlled Chaos in an Ordered Machine
50mHow random is Random? Pitfalls of Random in .NET 6
14mlol im so random!