diff options
| author | riastradh <riastradh@NetBSD.org> | 2019-09-02 20:09:29 +0000 |
|---|---|---|
| committer | riastradh <riastradh@NetBSD.org> | 2019-09-02 20:09:29 +0000 |
| commit | 069917fed439463990557abce97ec61cf1c0fc92 (patch) | |
| tree | ce410d37fe3b4318b01dcff158a261f5c0be783d /sys/dev/microcode | |
| parent | 512217e62d1f4735913718abc782c4ef4f3c43d1 (diff) | |
Switch from NIST CTR_DRBG with AES to NIST Hash_DRBG with SHA-256.
Benefits:
- larger seeds -- a 128-bit key alone is not enough for `128-bit security'
- better resistance to timing side channels than AES
- a better-understood security story (https://eprint.iacr.org/2018/349)
- no loss in compliance with US government standards that nobody ever
got fired for choosing, at least in the US-dominated western world
- no dirty endianness tricks
- self-tests
Drawbacks:
- performance hit: throughput is reduced to about 1/3 in naive measurements
=> possible to mitigate by using hardware SHA-256 instructions
=> all you really need is 32 bytes to seed a userland PRNG anyway
=> if we just used ChaCha this would go away...
XXX pullup-7
XXX pullup-8
XXX pullup-9
Diffstat (limited to 'sys/dev/microcode')
0 files changed, 0 insertions, 0 deletions
