H. Peter Anvin [Wed, 1 Aug 2012 21:31:41 +0000 (14:31 -0700)]
rngd: As long as FIPS error rates are low, re-try the same source
Allow for a small number of FIPS errors before advancing to the
next source. This prevents a high bandwidth source from stalling
out by shifting to a low bandwidth source (e.g. DRNG->TPM) just
because of a single FIPS failure. FIPS failures are frequent
enough (1:1250) that this happens on a regular basis.
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com> Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
H. Peter Anvin [Wed, 1 Aug 2012 21:31:40 +0000 (14:31 -0700)]
rngd: Initialize RNGs in order of preference
The DRNG entropy source, if present, is going to be orders of
magnitudes faster than most other sources, so initialize it
first so that it shows up first in the list.
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com> Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
H. Peter Anvin [Wed, 1 Aug 2012 21:31:39 +0000 (14:31 -0700)]
rngd: Allow up to a 1:1000 false error rate on FIPS tests
The FIPS tests have a measured false positive error rate of
approximately 1:1250. In order to not permanently disable a
functioning random number source under high traffic, allow
one failure per 1000 successful blocks.
However, never allow more than 25 subsequent failures; this is
handled by not allowing the failures counter to go below zero.
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com> Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
H. Peter Anvin [Wed, 1 Aug 2012 21:31:38 +0000 (14:31 -0700)]
rngd: don't open the TPM if hwrng is available
If /dev/hwrng is avaiable, do not open the TPM. Newer kernels export
TPM randomness via /dev/hwrng; this properly handles multiplexing of
the TPM so that we don't interfere with TrouSerS. Thus, we don't want
to open /dev/tpm0 if we can open /dev/hwrng.
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com> Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
H. Peter Anvin [Wed, 1 Aug 2012 21:31:36 +0000 (14:31 -0700)]
rngd_rdrand: Actually perform the correct AES data reduction
The pointers were confused in such a way that the AES data reduction
wasn't actually being performed. Furthermore, architecturally we need
a 512:1 data reduction, rather than 128:1. Finally, initialize the IV
to random value during startup and remove some unnecessary buffer
shuffling.
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com> Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
H. Peter Anvin [Wed, 1 Aug 2012 21:31:35 +0000 (14:31 -0700)]
drng: Move DRNG code to a separate file and make safe on non-x86
Move all the DRNG code to a separate file, and make sure it is
properly stubbed out on non-x86. Furthermore, fix the CPUID bits we
check for; in particular we need AES-ni for the whitening code.
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com> Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
H. Peter Anvin [Mon, 30 Jul 2012 21:48:09 +0000 (14:48 -0700)]
Change the default device from /dev/hw_random to /dev/hwrng
Change the default device name for the hardware random number device
from /dev/hw_random to /dev/hwrng, which is the filename documented in
devices.txt and appears to be the device name created by udev and
devtmpfs.
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com> Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
H. Peter Anvin [Mon, 30 Jul 2012 21:42:36 +0000 (14:42 -0700)]
rngd_linux: Modify write_wakeup_threshold to the fill threshold
The kernel.random.write_wakeup_threshold sysctl needs to be set to the
point where we want poll() on the random device to wake up. This
replaces the level check in ioctl() used during polling.
Set it by default to 3/4 to the value of kernel.random.poolsize.
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com> Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
Brad Hill [Tue, 17 Jul 2012 23:50:40 +0000 (19:50 -0400)]
Added -q and -v flags, updated help and man page
-q and --quiet flags to suppress error messages from rngd.c
-v and --verbose flags to list available entropy sources
help and man page reflect these changes and have minor fixes