David Goulet:
> Their big issue is the Ubuntu Cloud Image for which they rely on
> https://launchpad.net/pollinate, TL;DR; it fetches random bytes over
> HTTPS to seed /dev/random. (They do pin the certificate in the client
> which is less crazy :).
>
> See:
> http://blog.dustinkirkland.com/2014/02/random-seeds-in-ubuntu-1404-lts-cloud.html
>
> To be honest, I don't have a good way of fixing this issue. Feeding the
> urandom-seed with the date might be better than nothing but again I
> think that if a NTP correction occurs before seeding it, an attacker
> could end up knowing the seed if the NTP server or the link is
> malicious.
>
> Is it crazy to think that Tails could provide a "seeding server" and use
> pollinate?
I found an interesting comment about pollinate. [1]
> Sooo, let me get this right. Your VM has no good random seed to start
from. To deal with that you make an HTTPS request to some server on the
internet. That HTTPS connection requires a session key, which you have
to generate from your random source that, well..., is not well-seeded at
that point. Hence all the encryption of that seed is pretty much pointless.
Discussion is also interesting. [1]
What do you think? Is the https session key argument a good one against
pollinate?
[1]
https://plus.google.com/wm/1/+LennartPoetteringTheOneAndOnly/posts/K22yyHRc6hn
Cheers,
Patrick
