bug#23605: /dev/urandom not seeded across reboots

[Ludovic Courtès]

"Thompson, David" <address@hidden> skribis:

> On Tue, May 24, 2016 at 12:16 PM, Leo Famulari <address@hidden> wrote:

[...]

>> When I boot a GuixSD VM for the first time [0], it requires me to dance
>> on the keyboard until it has collected ~200 bits of entropy. I assumed
>> this is to properly bootstrap the CSPRNG in /dev/urandom, but I'm not
>> sure.
>
> This is just an annoying feature of GNU lsh.  I want to switch my
> machines to OpenSSH sometime, partly due to this.

It’s actually ‘lsh-make-seed’ that does that (info "(lsh)
lsh-make-seed"), and it’s invoked from our ‘lsh-service’ when
#:initialize? is #t (the default).

It’s possible to set #:initialize? to #f, but then you still need to
create (or provide) the random seed at some point.  At the time people
felt that having it default to #t would be less surprising.

> It impedes automated provisioning of servers, which OpenSSH does not do.

Maybe OpenSSH assumes that the kernel-provided randomness is good
enough?

Ludo’.