使用相同底層硬體的虛擬機的 /dev/urandom 衝突可能性

We have multiple virtual machines sharing the same physical hardware. We use /dev/urandom for session key generation. But a question comes up: if /dev/urandom utilizes metrics from the physical hardware for entropy, isn’t there an increased risk of duplicates for VMs on shared hardware if calls are made at the same exact time?

There are at least two important things that can go wrong with VM randomness:

1. They could end up with the same “entropy” input and produce same/related numbers.
2. Someone with access to one VM could be able to predict the “random” inputs of another VM.

In a simple setup each VM has their own pool, they get initialized with saved values on startup and they make their own measurements that they feed into the pool. Only on first start (or two starts from a checkpoint), when they have constant initialization could they start off with identical numbers and be slow to gather enough entropy to diverge. (If you have a CPU with RDRAND/RDSEED this should never happen, since that is mixed into the pool frequently.)

The second issue is more difficult to gauge. Again, access to hardware random numbers avoids the issue, but theoretically the other VM could have influence on or be able to predict the “random” measurements otherwise.

通常使用半虛擬化來永久處理問題。通過讓主人為客人生成獨立的隨機數，他們的隨機數生成器將生成獨立的數字。

引用自：https://crypto.stackexchange.com/questions/29947