libsodium mess

[Kurt Roeckx]

On Thu, Jan 19, 2017 at 02:30:35PM -0500, Eric S. Raymond wrote:
> Gary E. Miller <gem at rellim.com>:
> > > - to fuzz the low-order bits of the clock.
> > 
> > Hmm, can you expand on this a bit?  Which clock?  How much fuzz?
> > Does this degrade anything?
> 
> Whenever ntpd polls the system clock, it fuzzes the lowest-order digits
> of the result. The amount of fuzz to apply is bounded by half the measured
> interval between system clock ticks.
> 
> That shouldn't degrade anything. I presume it's a measure to foil timing
> attacks of some sort.  Daniel might be able to say more.

Adding random (white) noise to a measurement is done to improve the
resolution after averaging, it's ussually in combination with
oversampling. Adding this white noise is done in the analog signal,
before you convert it to digital.

I guess there is an assumption that there is a random time between
the clock tick and the time that you asked it, and that by adding
an other random time to it that you can somehow improve the
resolution. And I guess improving the resolution was important
when on some systems you have a resolution in the order of 1 to 50
ms.

But I'm currently not really sure that it either improves
things, make things worse, or has no effect at all.


Kurt