{"id":298,"date":"2010-02-08T19:32:59","date_gmt":"2010-02-09T03:32:59","guid":{"rendered":"http:\/\/www.outflux.net\/blog\/?p=298"},"modified":"2010-02-08T19:32:59","modified_gmt":"2010-02-09T03:32:59","slug":"rng-tools-with-tpm","status":"publish","type":"post","link":"https:\/\/outflux.net\/blog\/archives\/2010\/02\/08\/rng-tools-with-tpm\/","title":{"rendered":"rng-tools with TPM"},"content":{"rendered":"<p>In Ubuntu, I uploaded an rng-tools that supports the <a href=\"http:\/\/www.outflux.net\/blog\/archives\/2009\/10\/22\/tpm-as-rng\/\">RNG in TPM<\/a> devices (my patch is <a href=\"http:\/\/bugs.debian.org\/cgi-bin\/bugreport.cgi?bug=542599\">waiting<\/a> in Debian).  This hardware is available on a bunch of systems, including several Thinkpads and the Intel Q35, Q45 and newer main boards.<\/p>\n<p>While most TPM RNGs aren&#8217;t really heavy-duty hardware RNGs, they are at least a mild source of randomness.  I&#8217;ll be using an <a href=\"http:\/\/www.entropykey.co.uk\/\">entropy key<\/a> eventually, but for now, the TPM can supplement my collected entropy.<\/p>\n<p><code>\/etc\/default\/rng-tools<\/code>:<\/p>\n<blockquote><p>HRNGDEVICE=\/dev\/null<br \/>\nRNGDOPTIONS=&#8221;&#8211;hrng=tpm &#8211;fill-watermark=90% &#8211;feed-interval=1&#8243;<\/p><\/blockquote>\n<p>After it&#8217;s been running a bit:<\/p>\n<blockquote><p>\nFeb  8 19:10:51 linux rngd[13143]: stats: bits received from HRNG source: 6180064<br \/>\nFeb  8 19:10:51 linux rngd[13143]: stats: bits sent to kernel pool: 6166144<br \/>\nFeb  8 19:10:51 linux rngd[13143]: stats: entropy added to kernel pool: 4624608<br \/>\nFeb  8 19:10:51 linux rngd[13143]: stats: FIPS 140-2 successes: 309<br \/>\nFeb  8 19:10:51 linux rngd[13143]: stats: FIPS 140-2 failures: 0<br \/>\nFeb  8 19:10:51 linux rngd[13143]: stats: FIPS 140-2(2001-10-10) Monobit: 0<br \/>\nFeb  8 19:10:51 linux rngd[13143]: stats: FIPS 140-2(2001-10-10) Poker: 0<br \/>\nFeb  8 19:10:51 linux rngd[13143]: stats: FIPS 140-2(2001-10-10) Runs: 0<br \/>\nFeb  8 19:10:51 linux rngd[13143]: stats: FIPS 140-2(2001-10-10) Long run: 0<br \/>\nFeb  8 19:10:51 linux rngd[13143]: stats: FIPS 140-2(2001-10-10) Continuous run: 0<br \/>\nFeb  8 19:10:51 linux rngd[13143]: stats: HRNG source speed: (min=5.207; avg=6.145; max=6.200)Kibits\/s<br \/>\nFeb  8 19:10:51 linux rngd[13143]: stats: FIPS tests speed: (min=66.925; avg=75.789; max=112.861)Mibits\/s<br \/>\nFeb  8 19:10:51 linux rngd[13143]: stats: Lowest ready-buffers level: 0<br \/>\nFeb  8 19:10:51 linux rngd[13143]: stats: Entropy starvations: 308<br \/>\nFeb  8 19:10:51 linux rngd[13143]: stats: Time spent starving for entropy: (min=3150263; avg=3178447.994; max=3750848)us\n<\/p><\/blockquote>\n<p>And now the kernel entropy pool is high:<\/p>\n<blockquote><p>$ <strong>echo $(cat \/proc\/sys\/kernel\/random\/entropy_avail)\/$(cat \/proc\/sys\/kernel\/random\/poolsize)<\/strong><br \/>\n3968\/4096\n<\/p><\/blockquote>\n<p style='text-align:left'>&copy; 2010, <a href=\"https:\/\/outflux.net\/blog\/\">Kees Cook<\/a>. This work is licensed under a <a rel=\"license\" href=\"http:\/\/creativecommons.org\/licenses\/by-sa\/4.0\/\">Creative Commons Attribution-ShareAlike 4.0 License<\/a>.<br \/><a rel=\"license\" href=\"http:\/\/creativecommons.org\/licenses\/by-sa\/4.0\/\"><img decoding=\"async\" alt=\"CC BY-SA 4.0\" style=\"border-width:0\" src=\"https:\/\/i.creativecommons.org\/l\/by-sa\/4.0\/88x31.png\" \/><\/a> <\/p>\n","protected":false},"excerpt":{"rendered":"<p>In Ubuntu, I uploaded an rng-tools that supports the RNG in TPM devices (my patch is waiting in Debian). This hardware is available on a bunch of systems, including several Thinkpads and the Intel Q35, Q45 and newer main boards. While most TPM RNGs aren&#8217;t really heavy-duty hardware RNGs, they are at least a mild [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5,18,6,14,19],"tags":[],"_links":{"self":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts\/298"}],"collection":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/comments?post=298"}],"version-history":[{"count":3,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts\/298\/revisions"}],"predecessor-version":[{"id":301,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts\/298\/revisions\/301"}],"wp:attachment":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/media?parent=298"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/categories?post=298"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/tags?post=298"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}