[ruby-core:75343] [Ruby trunk Bug#9569] SecureRandom should try /dev/urandom first

Issue #9569 has been updated by Delan Azabani.


For anyone reading this thread after me:

* `SecureRandom.gen_random` calls `OpenSSL::Random.random_bytes` before falling back on `Random.raw_seed` [1]
* `Random.raw_seed` calls `fill_random_bytes` [2]
* `fill_random_bytes` calls `fill_random_bytes_syscall` before falling back on `fill_random_bytes_urandom` [3]
* `fill_random_bytes_syscall` is compiled to wrap `CryptGenRandom` if available, falling back on `getrandom(2)` [4]
* `fill_random_bytes_urandom` reads from `/dev/urandom` if it considers the device reasonable [5]

It’s good to see that `fill_random_bytes` already prefers `getrandom(2)` over `/dev/urandom`, as `getrandom(2)` blocks only if it has been called so early in the boot process that there isn’t enough *initial* entropy [6], and it isn’t susceptible to file descriptor exhaustion attacks [7].

Changing the order of `SecureRandom.gen_random` should be enough to fix this bug, but I would also suggest adding `arc4random(3)` or `getentropy(2)` to the collection of system calls tried by `fill_random_bytes_syscall`, which will mitigate file descriptor exhaustion attacks for OpenBSD users.

1. https://github.com/ruby/ruby/blob/8ef6dacb248876b444595a26ea78c35eb07a188b/lib/securerandom.rb#L50-78
2. https://github.com/ruby/ruby/blob/8ef6dacb248876b444595a26ea78c35eb07a188b/random.c#L620-635
3. https://github.com/ruby/ruby/blob/8ef6dacb248876b444595a26ea78c35eb07a188b/random.c#L549-555
4. https://github.com/ruby/ruby/blob/8ef6dacb248876b444595a26ea78c35eb07a188b/random.c#L493-547
5. https://github.com/ruby/ruby/blob/8ef6dacb248876b444595a26ea78c35eb07a188b/random.c#L444-481
6. http://www.2uo.de/myths-about-urandom/
7. https://lwn.net/Articles/606141/
8. http://man.openbsd.org/OpenBSD-current/man3/arc4random.3
9. http://man.openbsd.org/OpenBSD-current/man2/getentropy.2

----------------------------------------
Bug #9569: SecureRandom should try /dev/urandom first
https://bugs.ruby-lang.org/issues/9569#change-58472

* Author: Corey Csuhta
* Status: Rejected
* Priority: Normal
* Assignee: ruby-core
* ruby -v: 
* Backport: 
----------------------------------------
Right now, `SecureRandom.random_bytes` tries to detect an OpenSSL to use before it tries to detect `/dev/urandom`. I think it should be the other way around. In both cases, you just need random bytes to unpack, so SecureRandom could skip the middleman (and [second point of failure](http://sockpuppet.org/blog/2014/02/25/safely-generate-random-numbers/)) and just talk to `/dev/urandom` directly if it's available.

Is this a case of just re-ordering the two code chunks so that `/dev/urandom` is tried first?

Relevant lines: https://github.com/ruby/ruby/blob/trunk/lib/securerandom.rb#L59-L90



-- 
https://bugs.ruby-lang.org/

Unsubscribe: <mailto:[e-mail]?subject=unsubscribe>
<http://lists.ruby-lang.org/cgi-bin/mailman/options/ruby-core>