{"id":255,"date":"2009-10-22T22:43:29","date_gmt":"2009-10-23T06:43:29","guid":{"rendered":"http:\/\/www.outflux.net\/blog\/?p=255"},"modified":"2009-10-24T20:17:29","modified_gmt":"2009-10-25T04:17:29","slug":"tpm-as-rng","status":"publish","type":"post","link":"https:\/\/outflux.net\/blog\/archives\/2009\/10\/22\/tpm-as-rng\/","title":{"rendered":"TPM as RNG"},"content":{"rendered":"

I was reminded about some TPM<\/a> coding I’d done to get random bytes<\/a> from the pRNG on my TPM-enabled system from Matt Domsch’s recent post<\/a>. I’m not fully convinced that the pRNG of the TPM is an appropriate source of entropy, but it does pass my simple FIPS-140-2<\/a> test<\/a>.<\/p>\n

I had to find the Intel TPM docs<\/a> to figure out how to enable TPM on my system. It was under “Advanced \/ Peripherals”. I was expecting it under “Security”, like every other BIOS I’d seen. After that:<\/p>\n

<\/p>\n

\n$ sudo apt-get install trousers tpm-tools<\/strong>
\n...
\n$ sudo modprobe tpm_tis<\/strong>
\n$ dmesg | grep -i tpm<\/strong>
\n[676618.167313] tpm_tis 00:07: 1.2 TPM (device-id 0xFE, rev-id 70)
\n$ sudo service trousers start<\/strong>
\n...
\n$ tpm_version<\/strong>
\n TPM 1.2 Version Info:
\n Chip Version: 1.2.2.16
\n Spec Level: 2
\n Errata Revision: 1
\n TPM Vendor ID: WEC
\n TPM Version: 01010000
\n Manufacturer Info: 57454300
\n$ .\/tpm-getrand | hexdump -C<\/strong>
\n00000000 61 07 23 ff 71 3e 25 e8 f0 d5 de a7 a3 07 21 dc |a.#.q>%.......!.|\n<\/p><\/blockquote>\n

<\/code><\/p>\n

I could run rngd with a named pipe, but it’d be nice to have a new driver that could run a command instead to get the next 20000 bits.<\/p>\n

UPDATE<\/strong>: I’ve implemented<\/a> this in rngd now.<\/p>\n

© 2009, Kees Cook<\/a>. This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 License<\/a>.
\"CC<\/a> <\/p>\n","protected":false},"excerpt":{"rendered":"

I was reminded about some TPM coding I’d done to get random bytes from the pRNG on my TPM-enabled system from Matt Domsch’s recent post. I’m not fully convinced that the pRNG of the TPM is an appropriate source of entropy, but it does pass my simple FIPS-140-2 test. I had to find the Intel […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[18,6,14,19],"tags":[],"_links":{"self":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts\/255"}],"collection":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/comments?post=255"}],"version-history":[{"count":7,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts\/255\/revisions"}],"predecessor-version":[{"id":265,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts\/255\/revisions\/265"}],"wp:attachment":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/media?parent=255"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/categories?post=255"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/tags?post=255"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}