Jason A. Donenfeld, the author of the VPN WireGuard, has introduced patches that significantly speed up the retrieval of random numbers from the system through the getrandom() function, implemented via the corresponding system call in Linux. The advantage of this solution over using /dev/random or /dev/urandom is its immunity to file descriptor exhaustion attacks, which can lead to uninitialized and non-random cryptographic keys.
The proposed optimization is based on the use of the vDSO (virtual dynamic shared object) mechanism, which allows the system call handler to be moved from the kernel to user space, avoiding context switches. In the case of getrandom(), the implementation of the system call related to this function is handled in the form of vDSO, with code preloaded into the process's address space directly by the kernel. This approach has enabled the retrieval of random numbers to be accelerated in some situations by 15 times or more.
Source: opennet.ru
