Create random seed at installation time with Tails Installer
Given I just installed Tails on a USB stick When I boot it for the first time Then I want to have good entropy to create the persistent storage
Given I boot Tails from a USB stick When I do not activate my persistent volume in the Tails Greeter Then I still want to have good enough entropy from a random seed
For that, it is necessary to have the Tails Installer create a random seed in the system FAT partition at installation time.
At the November 4th meeting, we decided that this was a ticket we could start to work on.
We also decided to ask to tickets' assignee to write down a small presentation of the goal of their ticket, to be included in the blueprint that we'll show publicly. So it needs to be clear the ticket is about, what it will implement and why. There's already bits written in the blueprint dedicated paragraph, but it probably needs to be clarified for external readers. Please check and enhance it!
Use the Tails installer to create a better seed #11897
When Tails is installed the first time, the most common used method is downloading the Tails ISO image, verifying it is legitimate and then copying its content to create a running system. That means that every single user has exactly the same copy of Tails. This is good for verification, but also means that every user has the same initial random seed for CSPRNG operations, used to initialize the some of the most important cryptography functions such as TLS and disk encryption (Persistence), such that they may become predictable.
To solve this problem we plan to use the Tails installer, to initialize the random seed file on every new Tails. This should be a post installation mechanism, after verifying the ISO/disk image hash/signature. We plan to use the strongest random source available in the system where Tails Installer is running from, by Python's os.urandom .
- Assignee deleted (
- QA Check set to Info Needed
- Easy set to No
I have implemented a first draft solution for this ticket.
I have modified tails-installer as shown in the feature branch:
and Tails (including the blueprint) as shown in:
please review the updated blueprint for the detailed changes.
One question I have is if the changes to Tails itself should be in another ticket, or even in the "Persist entropy pool seeds" one #7675.