diff options
| author | Jakob Unterwurzacher | 2021-08-25 12:36:38 +0200 |
|---|---|---|
| committer | Jakob Unterwurzacher | 2021-08-25 12:39:17 +0200 |
| commit | 61ef6b00a675456ee05d40f1ce44d693bc4be350 (patch) | |
| tree | 2ce32b48bb31ff728622d75e110075f5a43a7cf4 /Documentation | |
| parent | b3d26b7264f3c025a48d19cb2784b83fc84a0ee4 (diff) | |
-devrandom: make flag a no-op
Commit f3c777d5eaa682d878c638192311e52f9c204294 added the `-devrandom` option:
commit f3c777d5eaa682d878c638192311e52f9c204294
Author: @slackner
Date: Sun Nov 19 13:30:04 2017 +0100
main: Add '-devrandom' commandline option
Allows to use /dev/random for generating the master key instead of the
default Go implementation. When the kernel random generator has been
properly initialized both are considered equally secure, however:
* Versions of Go prior to 1.9 just fall back to /dev/urandom if the
getrandom() syscall would be blocking (Go Bug #19274)
* Kernel versions prior to 3.17 do not support getrandom(), and there
is no check if the random generator has been properly initialized
before reading from /dev/urandom
This is especially useful for embedded hardware with low-entroy. Please
note that generation of the master key might block indefinitely if the
kernel cannot harvest enough entropy.
We now require Go v1.13 and Kernel versions should have also moved on.
Make the flag a no-op.
https://github.com/rfjakob/gocryptfs/issues/596
Diffstat (limited to 'Documentation')
| -rw-r--r-- | Documentation/MANPAGE.md | 9 |
1 files changed, 4 insertions, 5 deletions
diff --git a/Documentation/MANPAGE.md b/Documentation/MANPAGE.md index b9aa51b..acb0ff0 100644 --- a/Documentation/MANPAGE.md +++ b/Documentation/MANPAGE.md @@ -114,11 +114,10 @@ leaks information about identical file names across directories The resulting `gocryptfs.conf` has "DirIV" missing from "FeatureFlags". #### -devrandom -Use `/dev/random` for generating the master key instead of the default Go -implementation. This is especially useful on embedded systems with Go versions -prior to 1.9, which fall back to weak random data when the getrandom syscall -is blocking. Using this option can block indefinitely when the kernel cannot -harvest enough entropy. +Obsolete and ignored on gocryptfs v2.2 and later. + +See https://github.com/rfjakob/gocryptfs/commit/f3c777d5eaa682d878c638192311e52f9c204294 +and https://github.com/rfjakob/gocryptfs/issues/596 for background info. #### -hkdf Use HKDF to derive separate keys for content and name encryption from |