logoalt Hacker News

cpercivatoday at 5:46 AM1 replyview on HN

Re-seeding is easy. The hard parts are (a) finding everything which needs to be reseeded -- not just explicit RNGs but also things like keys used to pick outgoing port numbers in a pseudorandom order -- and (b) making sure that all the relevant code becomes aware that it was just forked -- not necessarily trivial given that there's no standard "you just got restarted from a snapshot" signal in UNIX.


Replies

Intermernettoday at 10:59 AM

I would have thought that in the days of containers, we'd have better tooling around this. Sounds like a goldmine for vuln research!