Re: [PATCH v1 1/2] random-bits: Factor out entropy generating function

[Adhemerval Zanella <adhemerval.zanella@linaro.org>]

On 29/03/2022 17:44, Noah Goldstein wrote:
> On Tue, Mar 29, 2022 at 3:37 PM Adhemerval Zanella
> <adhemerval.zanella@linaro.org> wrote:
>>
>>
>>
>> On 29/03/2022 16:56, Noah Goldstein wrote:
>>> On Tue, Mar 29, 2022 at 2:51 PM Adhemerval Zanella
>>> <adhemerval.zanella@linaro.org> wrote:
>>>>
>>>>
>>>>
>>>> On 28/03/2022 19:09, Noah Goldstein via Libc-alpha wrote:
>>>>> On some architectures `clock_gettime` is undesirable as
>>>>> it may use a syscall or there may be a faster alternative.
>>>>> Future architecture specific functions can be added in
>>>>> sysdeps/<arch>/random-bits-entropy.h to provide a version of
>>>>> 'random_bits_entropy' that doesn't use 'clock_gettime'.
>>>>> ---
>>>>>  include/random-bits.h                 | 16 ++++++--------
>>>>>  sysdeps/generic/random-bits-entropy.h | 31 +++++++++++++++++++++++++++
>>>>>  2 files changed, 37 insertions(+), 10 deletions(-)
>>>>>  create mode 100644 sysdeps/generic/random-bits-entropy.h
>>>>>
>>>>> diff --git a/include/random-bits.h b/include/random-bits.h
>>>>> index 17665b479a..016b87576c 100644
>>>>> --- a/include/random-bits.h
>>>>> +++ b/include/random-bits.h
>>>>> @@ -19,21 +19,17 @@
>>>>>  #ifndef _RANDOM_BITS_H
>>>>>  # define _RANDOM_BITS_H
>>>>>
>>>>> -#include <time.h>
>>>>> -#include <stdint.h>
>>>>> +# include <random-bits-entropy.h>
>>>>> +# include <stdint.h>
>>>>>
>>>>> -/* Provides fast pseudo-random bits through clock_gettime.  It has unspecified
>>>>> -   starting time, nano-second accuracy, its randomness is significantly better
>>>>> -   than gettimeofday, and for mostly architectures it is implemented through
>>>>> -   vDSO instead of a syscall.  Since the source is a system clock, the upper
>>>>> -   bits will have less entropy. */
>>>>> +/* Provides fast pseudo-random bits through architecture specific
>>>>> +   random_bits_entropy.  Expectation is source is some timing function so
>>>>> +   the upper bits have less entropy.  */
>>>>>  static inline uint32_t
>>>>>  random_bits (void)
>>>>>  {
>>>>> -  struct __timespec64 tv;
>>>>> -  __clock_gettime64 (CLOCK_MONOTONIC, &tv);
>>>>> +  uint32_t ret = random_bits_entropy ();
>>>>>    /* Shuffle the lower bits to minimize the clock bias.  */
>>>>> -  uint32_t ret = tv.tv_nsec ^ tv.tv_sec;
>>>>>    ret ^= (ret << 24) | (ret >> 8);
>>>>>    return ret;
>>>>>  }
>>>>
>>>> We already provide hp-timing.h, which uses rdtsc on x86 and clock_gettime on
>>>> generic interface (and other high precision timing on other architectures).
>>>> So I think a better way would be to:
>>>
>>> For x86/generic that works but other architectures also have hp-timing
>>> implementations that might not be suitable for this (i.e there might be
>>> an entropy regression).
>>
>> I would expect that the entropy of the hp-timing.h instruction would be similar
>> to the ones from system clock (which exception of legacy architecture like alpha),
>> but I haven't checked yet.
> 
> Would expect the same, but think it will probably take a test on a
> per-arch basis.
> 
> Also there are optimizations we can make since we only need the lower
> 32-bits and
> not a true timestamp.
> 
> I.e no multiply for generic. Also on x86 we can skip combining the
> results of rdtsc.

I tested the entropy on some different architectures:

aarch64:
$ ent gettime-random.txt 
Entropy = 7.293634 bits per byte.
$ ent hptiming-random.txt 
Entropy = 6.451314 bits per byte.

ia64:
$ ent gettime-random.txt 
Entropy = 7.613066 bits per byte.
$ ent hptiming-random.txt 
Entropy = 7.458615 bits per byte.

powerpc64le:
$ ent gettime-random.txt 
Entropy = 7.413584 bits per byte.
$ ent hptiming-random.txt 
Entropy = 7.243894 bits per byte.

sparc64
$ ent gettime-random.txt 
Entropy = 7.388590 bits per byte.
$ ent hptiming-random.txt 
Entropy = 7.602368 bits per byte.


So it seems that only aarch64 is really losing some entropy when using
hp-timing.h (not sure why).