{"id":682,"date":"2013-08-13T09:10:51","date_gmt":"2013-08-13T17:10:51","guid":{"rendered":"http:\/\/www.outflux.net\/blog\/?p=682"},"modified":"2013-08-13T15:11:58","modified_gmt":"2013-08-13T23:11:58","slug":"tpm-providing-devhwrng","status":"publish","type":"post","link":"https:\/\/outflux.net\/blog\/archives\/2013\/08\/13\/tpm-providing-devhwrng\/","title":{"rendered":"TPM providing \/dev\/hwrng"},"content":{"rendered":"<p>A while ago, I added <a href=\"http:\/\/www.outflux.net\/blog\/archives\/2010\/02\/08\/rng-tools-with-tpm\/\">support for the TPM&#8217;s pRNG<\/a> to the <a href=\"http:\/\/bugs.debian.org\/cgi-bin\/bugreport.cgi?bug=542599\"><code>rng-tools<\/code> package<\/a> in Ubuntu. Since then, Kent Yoder <a href=\"http:\/\/git.kernel.org\/linus\/578b016fdc91464c08c096f0c5952cae549fdb8f\">added TPM support directly into the kernel&#8217;s <code>\/dev\/hwrng<\/code><\/a> device. This means there&#8217;s no need to carry the patch in <code>rng-tools<\/code> any more, since I can use <code>\/dev\/hwrng<\/code> directly now:<\/p>\n<pre class=\"brush:shell\">\r\n# modprobe tpm-rng\r\n# echo tpm-rng >> \/etc\/modules\r\n# grep -v ^# \/etc\/default\/rng-tools\r\nRNGDOPTIONS=\"--fill-watermark=90%\"\r\n# service rng-tools restart\r\n<\/pre>\n<p>And as before, once it&#8217;s been running a while (or you send <code>SIGUSR1<\/code> to <code>rngd<\/code>), you can see reporting in syslog:<\/p>\n<pre class=\"brush:shell\">\r\n# pkill -USR1 rngd\r\n# tail -n 15 \/var\/log\/syslog\r\nAug 13 09:51:01 linux rngd[39114]: stats: bits received from HRNG source: 260064\r\nAug 13 09:51:01 linux rngd[39114]: stats: bits sent to kernel pool: 216384\r\nAug 13 09:51:01 linux rngd[39114]: stats: entropy added to kernel pool: 216384\r\nAug 13 09:51:01 linux rngd[39114]: stats: FIPS 140-2 successes: 13\r\nAug 13 09:51:01 linux rngd[39114]: stats: FIPS 140-2 failures: 0\r\nAug 13 09:51:01 linux rngd[39114]: stats: FIPS 140-2(2001-10-10) Monobit: 0\r\nAug 13 09:51:01 linux rngd[39114]: stats: FIPS 140-2(2001-10-10) Poker: 0\r\nAug 13 09:51:01 linux rngd[39114]: stats: FIPS 140-2(2001-10-10) Runs: 0\r\nAug 13 09:51:01 linux rngd[39114]: stats: FIPS 140-2(2001-10-10) Long run: 0\r\nAug 13 09:51:01 linux rngd[39114]: stats: FIPS 140-2(2001-10-10) Continuous run: 0\r\nAug 13 09:51:01 linux rngd[39114]: stats: HRNG source speed: (min=10.433; avg=10.442; max=10.454)Kibits\/s\r\nAug 13 09:51:01 linux rngd[39114]: stats: FIPS tests speed: (min=73.360; avg=75.504; max=86.305)Mibits\/s\r\nAug 13 09:51:01 linux rngd[39114]: stats: Lowest ready-buffers level: 2\r\nAug 13 09:51:01 linux rngd[39114]: stats: Entropy starvations: 0\r\nAug 13 09:51:01 linux rngd[39114]: stats: Time spent starving for entropy: (min=0; avg=0.000; max=0)us\r\n<\/pre>\n<p>I&#8217;m pondering getting this running in Chrome OS too, but I want to make sure it doesn&#8217;t suck too much battery.<\/p>\n<p style='text-align:left'>&copy; 2013, <a href=\"https:\/\/outflux.net\/blog\/\">Kees Cook<\/a>. This work is licensed under a <a rel=\"license\" href=\"http:\/\/creativecommons.org\/licenses\/by-sa\/4.0\/\">Creative Commons Attribution-ShareAlike 4.0 License<\/a>.<br \/><a rel=\"license\" href=\"http:\/\/creativecommons.org\/licenses\/by-sa\/4.0\/\"><img decoding=\"async\" alt=\"CC BY-SA 4.0\" style=\"border-width:0\" src=\"https:\/\/i.creativecommons.org\/l\/by-sa\/4.0\/88x31.png\" \/><\/a> <\/p>\n","protected":false},"excerpt":{"rendered":"<p>A while ago, I added support for the TPM&#8217;s pRNG to the rng-tools package in Ubuntu. Since then, Kent Yoder added TPM support directly into the kernel&#8217;s \/dev\/hwrng device. This means there&#8217;s no need to carry the patch in rng-tools any more, since I can use \/dev\/hwrng directly now: # modprobe tpm-rng # echo tpm-rng [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5,20,18,6,14,19],"tags":[],"_links":{"self":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts\/682"}],"collection":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/comments?post=682"}],"version-history":[{"count":4,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts\/682\/revisions"}],"predecessor-version":[{"id":686,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts\/682\/revisions\/686"}],"wp:attachment":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/media?parent=682"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/categories?post=682"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/tags?post=682"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}