Jason A. Donenfeld, the author of the WireGuard VPN, has proposed an updated implementation of the RDRAND pseudo-random number generator, responsible for the operation of the /dev/random and /dev/urandom devices in the Linux kernel. At the end of November, Jason was added to the list of maintainers of the random driver and has now published the first results of his work on its overhaul.
The new implementation is notable for transitioning to the use of the BLAKE2s hash function instead of SHA1 for entropy mixing operations. This change has enhanced the security of the pseudo-random number generator by eliminating the problematic SHA1 algorithm and removing the rewriting of the RNG initialization vector. As the BLAKE2s algorithm outperforms SHA1 in terms of performance, its application has also positively impacted the performance of the pseudo-random number generator (testing on a system with an Intel i7-11850H processor showed a speed increase of 131%). Another advantage of transitioning entropy mixing to BLAKE2 is the unification of the algorithms used—BLAKE2 is utilized in the ChaCha cipher, which is already used for extracting random sequences.
Additionally, improvements have been made to the cryptographically secure pseudo-random number generator CRNG, used in the getrandom call. The enhancements focus on limiting the use of the slow RDRAND generator when extracting entropy, which allows for a 3.7 times performance boost. Jason demonstrated that calling RDRAND makes sense only when CRNG is not yet fully initialized, but once CRNG initialization is complete, its value does not affect the quality of the generated sequence, and it is possible to avoid calling RDRAND in this case.
The changes are slated to be included in version 5.17 of the kernel and have already been reviewed by developers Ted Ts’o (the second maintainer of the random driver), Greg Kroah-Hartman (responsible for maintaining the stable branch of the Linux kernel), and Jean-Philippe Aumasson (author of the BLAKE2/3 algorithms).
Source: opennet.ru
