"random: crng init done" string appear on the luks passphrase enter step

[almazyan]

How to file a helpful issue

Qubes OS release

R4.1.1

Brief summary

I see a "random: crng init done" string on the luks passphrase enter step when I hide Plymouth boot screen.

Steps to reproduce

Boot as usual. When you see Plymouth Boot Screen push left arrow button to hide the screen. You will see "Please enter passphrase for disk ..."
Wait couple of seconds and "...random: crng init done..." string will appear.
It might be a security issue.

Please have a look a video of the issue here https://twitter.com/almaz_aliev_/status/1609217144683745280?s=20&t=95ua5nZhJza-FLWogRfWsA

Expected behavior

I shouldn't see anything except my hidden passphrase

Actual behavior

"...random: crng init done..." string appear at the passphrase entering step

[zithro]

TL;DR: ignore the message and enter your password as if the message(s) wasn't there. Solutions to speed up the PRNG init are below.

“random: crng init done”, is related to the kernel initializing the pseudo-random number generator (PRNG, in /dev/[u]random). Sometimes it needs more time than usual to initialize, because the system does not have enough data to produce proper (pseudo-)randomness.
In your logs, we can see "random: systemd: uninitialized random read [...]", which is repeated many times ("148 urandom warnings missed due to rate limiting").
It means some program wants a random number, but the PRNG is not ready.

What happens is that the PRNG takes time to initialize, and reports back on tty1/VT1 AFTER the LUKS password is requested.
Note those kind of “text spitting” happens often on VT1, which is the first text console of a system.
(Well, on servers anyways, as it seems “desktop” installs usually block this text spitting on VT1).

Anyways, the "fun" thing is you can still type your password and it will work.
The text output, even if displayed on the same line as the LUKS password, is only considered as display, not user entry.
This is not specific to this error message, but all of them : display and user input are handled differently, even if for we humans, it looks strange.

If it really freaks you out, you can speed up the PRNG initialization by :

• moving your mouse during boot,
• install the "haveged" package : "haveged is a userspace entropy daemon which is not dependent upon the standard mechanisms for harvesting randomness for the system entropy pool. This is important in systems with high entropy needs or limited user interaction (e.g. headless servers)".

If you want a more detailed answer about the PRNG, check this: https://stackoverflow.com/questions/59249941/what-is-random-crng-init-done/61238433#61238433

[zithro]

TL;DR for maintainers: not a bug

[andrewdavidwong]

Closing as "not a bug" (the reported behavior is not a bug and is already working as intended). If anyone believes this is a mistake, please leave a comment, and we'll be happy to take another look. Thank you.

[zithro]

While it's not a bug, users may be disturbed by this message : "what should I do ?".
The problems :

• it happens randomly, and during early boot, when the user may not have access to another device to look up for an explanation/solution
• the message is output on a "Enter password" line
• it can slow down the boot time on some systems

Suggestions :

• install haveged in dom0 by default, more below
• find a way to remove the output from VT1. It won't solve the boot speed, but Qubes need powerful CPUs anyways ?
• (train/warn the user to move the mouse on boot ?)

About haveged, I read on its README that despite having been "~integrated" into the kernel since 5.4, it's still useful when a system needs randomness early in the boot process, before the CRNG in the Linux kernel gets fully initialized.
I believe it's the case for cryptsetup/LUKS during dom0 boot.

Ressources :
https://github.com/jirka-h/haveged/blob/master/README.md
jirka-h/haveged#57 (is haveged still useful/relevant?)
#673 (issue about haveged in qubes/domUs, not Qubes/dom0)
https://wiki.debian.org/BoottimeEntropyStarvation (generic explanation, some parts outdated)

[andrewdavidwong]

If this message shows up only when the user manually switches to a VT (away from the default GUI), then I don't think it's a problem, because this is an advanced user (or at least wants to act like one), and advanced users can be expected to look up messages first before being freaked out by them. ;)

[zithro]

Ok, it won't solve the boot speed problems on affected machines, but that makes sense ;)

[almazyan]

FYI, I don't have anymore "random: crng init done" string appearing during the boot.
I guess it is due to an update in dom0 (I saw something about "kernel" in the update process).
Thank everyone!