<div dir="ltr">haveged is worth mentioning as pretty good alternative solution <div><br></div><div><br></div><div><a href="http://www.issihosts.com/haveged/">http://www.issihosts.com/haveged/</a><br></div><div><br></div><div>
Cheers,</div><div><br></div><div>Juergen</div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Fri, Dec 13, 2013 at 9:32 AM, Sven Kieske <span dir="ltr"><<a href="mailto:S.Kieske@mittwald.de" target="_blank">S.Kieske@mittwald.de</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Answering myself, it seems<br>
virtio-rng will be in 3.4:<br>
<a href="https://bugzilla.redhat.com/show_bug.cgi?id=977079" target="_blank">https://bugzilla.redhat.com/show_bug.cgi?id=977079</a><br>
<br>
But I don't find it in the planning:<br>
<br>
<a href="https://docs.google.com/spreadsheet/ccc?key=0AuAtmJW_VMCRdHJ6N1M3d1F1UTJTS1dSMnZwMF9XWVE&usp=sharing#gid=0" target="_blank">https://docs.google.com/spreadsheet/ccc?key=0AuAtmJW_VMCRdHJ6N1M3d1F1UTJTS1dSMnZwMF9XWVE&usp=sharing#gid=0</a><br>
<br>
Nevertheless it would be cool if someone could give some advice<br>
how to handle entropy until 3.4 gets released<br>
(and I have time to upgrade).<br>
<br>
Am 13.12.2013 09:09, schrieb Sven Kieske:<br>
<div class="HOEnZb"><div class="h5">> Hi,<br>
><br>
> I'm just wondering: How is the state<br>
> of the virtio-rng implementation?<br>
><br>
> I'm asking because I need to regenerate<br>
> ssh host keys in newly deployed vms.<br>
><br>
> (I seem to be the only person, or everybody<br>
> else has found the solution, or nobody thinks<br>
> about security, or a mixture of the above?)<br>
><br>
> Additional I found no really guidance<br>
> on how much entropy bits should be<br>
> available to generate a secure key<br>
> inside a vm, beside these numbers:<br>
><br>
> <a href="http://www.ietf.org/rfc/rfc1750.txt" target="_blank">http://www.ietf.org/rfc/rfc1750.txt</a><br>
> suggests about 128 bits of entropy<br>
> for a single cryptographic operation.<br>
><br>
> various other sources mention ranges<br>
> between 100-200 or even at least 4096<br>
> entropy bits.<br>
><br>
> Would it be a workaround to add a virtual<br>
> sound device and use this one for /dev/random ?<br>
> (But it would be useless if you have no real sound hardware I guess).<br>
><br>
> Additional when you want to regenerate host keys in e.g. Ubuntu<br>
> 3 Keys get generated so you need even more entropy to be on the<br>
> save side.<br>
><br>
> If you got any links to best practices or some<br>
> good news regarding the state of virtio-rng that would be awesome.<br>
><br>
> Currently my vms have around 130-160 entropy bits available.<br>
><br>
<br>
--<br>
Mit freundlichen Grüßen / Regards<br>
<br>
Sven Kieske<br>
<br>
Systemadministrator<br>
Mittwald CM Service GmbH & Co. KG<br>
Königsberger Straße 6<br>
32339 Espelkamp<br>
T: +49-5772-293-100<br>
F: +49-5772-293-333<br>
<a href="https://www.mittwald.de" target="_blank">https://www.mittwald.de</a><br>
Geschäftsführer: Robert Meyer<br>
St.Nr.: 331/5721/1033, USt-IdNr.: DE814773217, HRA 6640, AG Bad Oeynhausen<br>
Komplementärin: Robert Meyer Verwaltungs GmbH, HRB 13260, AG Bad Oeynhausen<br>
_______________________________________________<br>
Users mailing list<br>
<a href="mailto:Users@ovirt.org">Users@ovirt.org</a><br>
<a href="http://lists.ovirt.org/mailman/listinfo/users" target="_blank">http://lists.ovirt.org/mailman/listinfo/users</a><br>
</div></div></blockquote></div><br><br clear="all"><div><br></div>-- <br><pre>Sent from the Delta quadrant using Borg technology!</pre>
</div>