[Cryptography] random numbers on virtual machines?

[Jerry Leichter]

On Jan 26, 2015, at 8:22 PM, Tom Mitchell <mitch at niftyegg.com> wrote:
> Virtual machines have difficulty exporting individual hardware resources 
> to multiple VMs.
I think that first "Virtual machines" was supposed to be "Physical machines", or something of that sort.

>   The hardware foundations of good RNG devices do not lend themselves
> to virtualization  and/or  multiplexing the way network connections do.  So 
> yes, better solutions should be considered.   Multiplexing the host random
> bits can involve a mutual exclusion lock that slows things down....
This makes little sense.  You could make the exact same statement about distributing the random bits to different processes.

Looked at "from the bottom up", the generator on the host system - whether dedicated hardware or software that depends on whatever physical processes we've decided produce sufficient randomness - sees a certain demand for random bits coming from the entire software stack above it.  It has to supply suitably random, suitably uncorrelated bits to meet that demand.  Whether that demand, at some higher level of abstraction, comes from a single thread of execution in a single program; a bunch of threads in a single program; a bunch of processes each running a separate program; a bunch of containers each running a bunch of processes; or a bunch of virtual machines each running its own OS - makes absolutely no difference in the correctness conditions for the low-level generator.

Yes, as soon as you move from multiple threads in one program to multiple processes, you have users of that stream of random bits who don't trust each other, so you need to provide suitable levels of protection between them.  But that's hardly a new problem (if one that's subtle and difficult to solve).

                                                        -- Jerry