Problem - Kevin Tafuro

Discussion
We strongly recommend that you do not increase your entropy estimates
based on any kernel state collected, particularly on a system that
is mostly idle. Much of the time, kernel state changes more slowly
than people think. In addition, attackers may be able to query the
same data and get very similar results.
The internal state of an operating system can change quickly, but that does not mean
there is necessarily any entropy there to collect. See Recipe 11.19 for a discussion
about estimating how much entropy you are getting.
Definitely do not query sources like these very often, because you are unlikely to get
additional entropy running in a tight loop, and the overhead involved is extremely
high.
On systems with a /proc filesystem, pretty much all of the interesting operating system–specific
information you might want to query is available by reading the files in
the /proc directory. The contents of the files in that directory are updated as the user
reads from those files. Open the files anew every time you want to poll for possible
entropy.
On systems without /proc, you can try to get information by running commands
that might change frequently and capturing all the data in the command. Be sure to
call out to any commands you run in a secure manner, as discussed in Recipes 1.7
and 1.8.
When calling commands, state does not actually change very quickly at all, particularly
on systems with few users. It is popular to query the ps and df commands (using
the flags that give the most entropy, of course), but there is often almost no entropy
in the output they produce.
Other commands that some operating systems may have, where there might be some
frequent change (though we would not count on it) include the following:
• sysctl: Use the -A flag.
• iostat
• lsof
• netstat: Use the -s flag if you want to see highly detailed information that may
change frequently on machines that see a lot of network traffic.
• pstat
• tcpdump: Ask it to capture a small number of packets.
• vmstat
Gathering Entropy from System State | 645
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.