The man-db compatibility issue with hardened_malloc has been resolved: git.savannah.gnu.org/cgit/man-db.gi. This will also fix compatibility with ports of OpenBSD malloc and other libc hardening triggering calls to getrandom, such as secondary stack randomization if man-db spawns threads.
Conversation
There's a single call to getrandom during init for the init CSPRNG. For efficiency, that's used to seed all the others, but it has no use after that and is unmapped. The reason getrandom is called again is regularly reseeding as a minor security boost: github.com/GrapheneOS/har.
1
3
Originally I started out with caching the output of getrandom directly, but that's at least an order of magnitude too slow even with the system call cost amortized. Even the current optimized scalar ChaCha8 implementation with highly optimized random range generation is too slow.
1
Replying to
Yes, I use ChaCha8 rather than ChaCha20 because it has much higher throughput and it's still more than strong enough for the use case of probabilistic memory corruption mitigations:
github.com/GrapheneOS/har
ChaCha8 is the same code as ChaCha20 with 8 rounds instead of 20 rounds.
2
3
Replying to
ah. I'm looking for a cipher fast enough for a 8051. ChaCha20 is just a little bit too slow... though even making it 2x faster would probably not help. all the 32-bit ops really kill the performance
2
1
2
Replying to
I don't think you'll be able to do much better than ChaCha8 or ChaCha12 while still retaining security right now. eprint.iacr.org/2018/720.pdf source.android.com/security/encry is the new disk encryption algorithm for low-end Android devices without AES acceleration based around using ChaCha12.
1
1
Replying to
My understanding is Speck performance is comparable to ChaCha when using a comparable security margin. There was interest in it for Android because it's a block cipher which is easier to use for disk encryption but due to the controversy they figured out how to make ChaCha work.
Replying to
but that's on a load-store architecture, right? not on some shitty micro that can only do 8-bit adds against the accumulator and so out of 2k ChaCha20 expands to, 1k is just movs
1
Show replies