Messages in this thread |  | | | Date | Thu, 24 Mar 2005 15:54:39 -0500 | | From | Jeff Garzik <> | | Subject | Re: [PATCH] API for true Random Number Generators to add entropy (2.6.11) |
David McCullough wrote: > Jivin Jeff Garzik lays it down ... > >>Evgeniy Polyakov wrote: >> >>>On Thu, 2005-03-24 at 14:27 +1000, David McCullough wrote: >>> >>> >>>>Hi all, >>>> >>>>Here is a small patch for 2.6.11 that adds a routine: >>>> >>>> add_true_randomness(__u32 *buf, int nwords); >>>> >>>>so that true random number generator device drivers can add a entropy >>>>to the system. Drivers that use this can be found in the latest release >>>>of ocf-linux, an asynchronous crypto implementation for linux based on >>>>the *BSD Cryptographic Framework. >>>> >>>> http://ocf-linux.sourceforge.net/ >>>> >>>>Adding this can dramatically improve the performance of /dev/random on >>>>small embedded systems which do not generate much entropy. >>> >>> >>>People will not apply any kind of such changes. >>>Both OCF and acrypto already handle all RNG cases - no need for any kind >>>of userspace daemon or entropy (re)injection mechanism. >>>Anyone who want to use HW randomness may use OCF/acrypto mechanism. >>>For example here is patch to enable acrypto support for hw_random.c >>>It is very simple and support only upto 4 bytes request, of course it >>>is >>>not interested for anyone, but it is only 2-minutes example: >> >>If you want to add entropy to the kernel entropy pool from hardware RNG, >>you should use the userland daemon, which detects non-random (broken) >>hardware and provides throttling, so that RNG data collection does not >>consume 100% CPU. >> >>If you want to use the hardware RNG directly, it's simple: just open >>/dev/hw_random. >> >>Hardware RNG should not go kernel->kernel without adding FIPS tests and >>such. > > > For reference, the RNG on the Safenet I am using this with is > FIPS140 certified. I believe the HIFN part is also but I place the doc that > says so.
FIPS certification is not relevant to the discussion.
I am talking about active testing of -all data- that is produced by an RNG, before making use of it. Please read the source code of rngd.
Jeff
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
|  |