Jason A. Donenfeld, a VPN WireGuard author, introduced patches that significantly speed up the retrieval of random numbers from the system via the getrandom() function implemented through the corresponding system call in Linux. The advantage of this solution compared to using /dev/random or /dev/urandom is its immunity to file descriptor exhaustion attacks, which can lead to uninitialized and non-random cryptographic keys.
The proposed optimization is based on the use of the vDSO (virtual dynamic shared object) mechanism, which allows transferring the system call handler from the kernel to user space and avoiding context switches. In the case of getrandom(), the implementation of the system call related to this function is formatted as vDSO, with the code preloaded into the process's address space directly by the kernel. This approach enabled speeding up the retrieval of random numbers in some situations by 15 times or more.
Forrás: opennet.ru
