Doug: From the compatibility point, may PcdEnforceSecureRngAlgorithms default value be set to FALSE?
Thanks Liming 发件人: devel@edk2.groups.io <devel@edk2.groups.io> 代表 Doug Flick via groups.io 发送时间: 2024年5月10日 2:21 收件人: Ard Biesheuvel <a...@kernel.org>; devel@edk2.groups.io 主题: Re: [edk2-devel] [PATCH v2 03/13] OvmfPkg:PlatformCI: Support virtio-rng-pci So this patch is necessary as otherwise, QEMU fails to boot due to a missing source of randomness in the network drivers, right? So I added this based on your initial suggestion to get the ArmVirtPkg working - running it locally (and against the pipelines) shows this isn't necessary. So I'll drop the commits. There were concerns around compatibility, however the only fallback we would be able to do from NetworkPkg is depend on the time based LCG that we've considered a high profile CVE. This is where NetworkPkg must depend on the platform to provide it Rng and Hashing services. Fundamentally the platform must own it's own security. RNDR raises another interesting problem, by the way - the ARM arch spec requires RNDR to be backed by an appropriate DRBG that complies with the NIST spec but it does not specify which one. IOW, it is backed by a DRBG not by a raw entropy source, but specifying which DRBG (by GUID) is not generally feasible, as the guest VM firmware cannot interrogate the host about which DRBG is behind RNDR. This is why the PCD PcdEnforceSecureRngAlgorithms exists. The platform can make the determination to depend on default if they understand the security implications behind that. Additionally, the platform is free to override RngDxe and provide their own implementations. -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#118779): https://edk2.groups.io/g/devel/message/118779 Mute This Topic: https://groups.io/mt/106013302/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
