Changeset 1077

Show
Ignore:
Timestamp:
08/09/07 03:34:27 (1 year ago)
Author:
robert
Message:

Updated entropy hint

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • trunk/entropy.txt

    r953 r1077  
    11AUTHOR:         Robert Connolly <robert at linuxfromscratch dot org> (ashes) 
    22 
    3 DATE:           2005-04-09 
     3DATE:           2007-05-16 
    44 
    55LICENSE:        Public Domain 
    66 
    7 SYNOPSIS:       Random number generation 
     7SYNOPSIS:       Entropy and random number generators in Linux 
    88 
    99PRIMARY URL:    http://www.linuxfromscratch.org/hints/ 
    1010 
    1111DESCRIPTION: 
    12 Many system components including stack smashing protector, mktemp, and 
    13 cryptography, depend on a supply of random bits to ensure data integrity. 
    14 In the Linux kernel a combination of input devices are used to gather 
    15 randomness from. This includes the keyboard, mouse, network, and hard disc. 
    16 On an idle system none of these devices are receiving input, and the entropy 
    17 (randomness) of the system is easy to deplete, especially with cryptography. 
     12The word "entropy" generally means "chaos", "disorder", or "uncertainty". In 
     13this hint "entropy" is used to describe random computer data. 
     14 
     15Many system components depend on entropy (random numbers) for various tasks. 
     16One of the simplest examples would be the fortune(6) program, which gives a 
     17random quote from a list when we log in. Another simple example is a solitaire 
     18card game, or the shuffle option in a music player. Without random numbers 
     19these programs would generate the same results every time they run. The above 
     20examples are low security applications. It is not critical for them to use 
     21high quality random numbers, and in applications like these the current system 
     22time and date is usually an adequate source of entropy. 
     23 
     24Examples of medium security uses for entropy would be applications like 
     25mktemp(1), password salt, or the Stack Smashing Protector (SSP) GCC feature. 
     26These applications need unpredictable entropy to function securely, but the 
     27life span of these applications is generally short, so they do not need to use 
     28the highest quality entropy available. Using the system time is unsafe for 
     29these applications because it is predictable. 
     30 
     31Cryptographic keys tend to have a very long life, often several years. Even 
     32after the key is eventually replaced, everything it was used to encrypt remains 
     33only as safe as the entropy used to generate the key. For cryptography we want 
     34to use the best entropy possible, and conserve this high quality entropy 
     35specifically for cryptography. 
     36 
     37Generating true entropy in a computer is fairly difficult because nothing, 
     38outside of quantum physics, is random. The Linux kernel uses keyboard, mouse, 
     39network, and disc activities, with a cryptographic algorithm (SHA1), to 
     40generate data for the /dev/random device. One of the problems with this is that 
     41the input is not constant, so the kernel entropy pool can easily become empty. 
     42The /dev/random device is called a "blocking device". This means if the entropy 
     43pool is empty applications trying to use /dev/random will have to wait, 
     44indefinitely, until something refills the pool. This is both a feature and a 
     45nuisance, and can cause a denial of service depending on the application. 
     46Another problem with using the keyboard, mouse, network, and disc activity is 
     47that on idle, unmanned, and disc-less systems there is very little, or no, input 
     48of this kind. It is also theoretically possible for an observer (keyboard or 
     49network sniffer) to predict the entropy pool without having root level access. 
     50The only real solution to these vulnerabilities is in using a hardware-based 
     51random number generator. These hardware devices usually use electrical static 
     52as a source of entropy, because there is currently no technology that can 
     53reliably predict this. The best hardware random number generators use 
     54radioactive decay as an entropy source. 
     55 
     56The /dev/urandom device is referred to as a pseudo-random device (like-random), 
     57although /dev/random is also pseudo-random but to a lesser extent. /dev/urandom 
     58uses small amounts of data from /dev/random to seed a secondary entropy pool. 
     59This has the effect of inflating the real entropy so it can be conserved. Using 
     60/dev/urandom can cause /dev/random's pool to become empty, but if this happens 
     61/dev/urandom will not block, and it will continue using the last available 
     62seed. This makes /dev/urandom theoretically vulnerable to outputting repeating 
     63data, depending on the limitations of the algorithm used, but this is extremely 
     64rare and to my knowledge has never actually happened. /dev/urandom is widely 
     65considered safe for all cryptographic purposes, except by the most paranoid 
     66people. 
     67 
     68This hint contains links to web sites and patches to help you get more entropy, 
     69and use it more conservatively. 
    1870 
    1971PREREQUISITES: 
    20 For Pseudo_random/Frandom and arc4random, LFS-6.0 is needed. 
     72Glibc-2.5, for the arc4random patch. 
    2173The entropy daemons have no prerequisites. 
    2274 
    2375HINT: 
    2476 
    25 --- Descriptions --- 
    26 These are some methods of gathering and preserving entropy. 
    27  
    28 - Hardware random: 
     77        Contents: 
     78                Gkernel hwrandom daemon 
     79                Audio/Video entropy daemon 
     80                LavaRnd entropy daemon 
     81                Frandom and Erandom kernel drivers 
     82                Fortuna kernel driver 
     83                Arc4random library 
     84                Entropy pool size 
     85                OpenSSL modifications 
     86                Testing 
     87 
     88- Gkernel hwrandom daemon: 
    2989http://linuxcertified.com/hw_random.html 
    3090Some systems have hardware devices for random numbers. The kernel supports 
    …… 
    3292http://sourceforge.net/projects/gkernel/ 
    3393 
     94The installation is strait forward for Glibc: 
     95 
     96./configure --prefix=/usr && 
     97make && 
     98make install 
     99 
     100--- End Glibc installation --- 
     101 
     102The installation is a little messy for uClibc: 
     103uClibc does not have argp, because argp is not defined by any standard and 
     104does not belong in a C library (it's Glibc specific). So get the stand-alone 
     105argp library: 
     106http://www.lysator.liu.se/~nisse/misc/argp-standalone-1.3.tar.gz 
     107 
     108For uClibc first unpack argp-standalone, we don't need to install this: 
     109 
     110cd argp-standalone-1.3 && 
     111./configure --prefix=/usr && make 
     112 
     113Then unpack rng-tools: 
     114 
     115cd rng-tools-2 && 
     116env LIBS=-largp \ 
     117        CFLAGS="-O2 -L../argp-standalone-1.3 -I../argp-standalone-1.3" \ 
     118        ./configure --prefix=/usr && make && make install 
     119 
     120--- End uClibc installation --- 
     121 
     122rng-tools expects to find /dev/hw_random. This device was renamed to 
     123/dev/hwrandom in Linux-2.6, so you may need to start 'rngd' like this: 
     124 
     125rngd -r /dev/hw_random 
     126 
     127This should be started on boot just like audio-entropyd, below. 
     128 
     129This package comes with a test program named 'rngtest'. 
     130 
    34131- Audio/Video entropy daemon: 
    35132http://www.vanheusden.com/aed/ 
    36133http://www.vanheusden.com/ved/ 
    37 This describes two daemons which use either the static noise from the 
    38 system audio, or the video frames from a video4linux device. These devices 
    39 have a never ending supply of randomness created by thermal fluctuation and 
    40 electric fields on the devices. These entropy gathering daemons depend on the 
    41 kernel driver for your hardware to work properly, be it your sound or video 
    42 card. These programs will re-seed the kernel entropy pool. The programs can 
    43 be used together in combination with the kernel's internal values to create 
    44 a very random pool from several different sources. 
    45  
    46 - LavaRnd Random Number Generator: 
     134These two daemons use either the static noise from the sound card, or the video 
     135frames from a video4linux device. These devices have a never ending supply of 
     136entropy created by thermal fluctuation and electric fields on the devices. 
     137These entropy gathering daemons depend on the kernel driver for your hardware, 
     138to work properly, be it your sound or video card. These programs will refill 
     139the kernel entropy pool as needed. The programs can be used together in 
     140combination, including with Gkernel, to maintain a kernel entropy pool which 
     141uses several different sources. 
     142 
     143http://www.vanheusden.com/aed/audio-entropyd-0.0.6.tgz 
     144 
     145make && 
     146install -g 0 -o 0 -m 755 audio-entropyd /usr/sbin/audio-entropyd 
     147 
     148Edit your /etc/rc.d/init.d/random and start audio-entropyd just after seeding 
     149urandom, and stop it just after saving random-seed. Or use the boot script 
     150template and make a dedicated boot script. The PID file will be in /var/run. 
     151You don't need to reboot to use it, but you do need your sound card driver 
     152loaded, and be root. Add something like this: 
     153 
     154if [ -f /usr/sbin/audio-entropyd ] && [ -c /dev/dsp ]; then 
     155        echo "Starting audio entropy daemon..." 
     156        loadproc /usr/sbin/audio-entropyd 
     157fi 
     158 
     159and... 
     160 
     161echo "Stopping audio entropy daemon..." 
     162killproc /usr/sbin/audio-entropyd 
     163 
     164http://www.vanheusden.com/ved/video_entropyd-0.7.tgz 
     165 
     166make && 
     167install -g 0 -o 0 -m 755 video_entropyd /usr/sbin/video_entropyd 
     168 
     169Add this to root's crontab every minute or so. It can not run as a daemon 
     170because it will lock the video device. Depends on video4linux. Using one or 
     171both of these daemons should be adequate for sustained moderate-to-heavy use. 
     172 
     173Nothing else needs to be done, applications can continue to use /dev/random 
     174and /dev/urandom normally. You should notice crypt keys get made faster. 
     175 
     176Note: I have not personally used video_entropyd. 
     177 
     178- LavaRnd entropy daemon: 
    47179http://www.lavarnd.org/ 
    48180This uses hardware as a source of entropy much like Video Entropy Daemon. 
    49  
    50 - Pseudo random - Frandom, Erandom, and Urandom: 
     181I have not personally used this daemon. 
     182 
     183- Frandom and Erandom kernel drivers: 
    51184http://frandom.sourceforge.net/ 
    52 Frandom, and erandom, use md5 hashes of seeds taken from the kernel entropy 
    53 pool. Erandom is seeded from the state of frandom and uses no kernel entropy, 
    54 but consequently is unsafe for cryptography. Frandom is seeded directly from 
    55 the kernel entropy pool, but only once per use, and can provide gigabytes of 
    56 output while only consuming 256 bytes of kernel entropy. To reseed erandom 
    57 simply use frandom, such as dumping one block from frandom to /dev/null. Sysctl 
    58 interfaces are available to provide entropy through chroot. Sysctl is a single 
    59 thread interface, so the devices in /dev are attempted first. Even if the 
    60 devices in /dev are not available sysctl has performed very well. The frandom, 
    61 erandom, and sysctl urandom devices and interfaces are available from the 
    62 pseudo_random kernel patch. 
    63  
    64 - Arc4random: 
    65 In this implementation the Libc patches for arc4random provide two key 
    66 functions, arc4random() and arc4randomII(). arc4random() uses urandom and is 
    67 intended for cryptographic applications, arc4randomII() uses erandom and is 
    68 intended for non-cryptographic applications. Both of these functions include 
    69 gettimeofday(2) when initializing, making it impossible to generate the same 
    70 sequence twice, even if the kernel random generator (urandom) has crashed. 
    71 The first 256 long words (1024 bytes) are discarded due to a 'known text' 
    72 weakness in the rc4 cipher. There is a man page provided with the Libc patches. 
    73 The man page for arc4random(3) provided by OpenBSD assumes arc4random() uses 
    74 arandom, and it is incorrect for this implementation. The Libc patches also 
    75 patch mktemp(3) to use arc4randomII(). OpenSSL and OpenSSH can use arc4random() 
    76 too. OpenSSL needs a patch, OpenSSH will find arc4random() with its configure 
    77 script. 
     185Frandom stands for "fast random". Erandom stands for "economical random". 
     186They both use the arcfour algorithm 
     187 
     188The /dev/frandom device is similar to /dev/urandom except that it only takes 
     189one single seed from /dev/random, each time it is opened. As a result it is 
     190able to output random data much faster than /dev/urandom because there is 
     191no stirring of frandom's pool. This is ideal for wiping discs, or any time you 
     192need gigabytes of random data. 
     193 
     194The /dev/erandom device uses the constantly changing state of frandom's pool, 
     195in a read-only mode, for entropy. /dev/erandom consumes no entropy from 
     196/dev/random, and is ideal for applications that want to open the device 
     197thousands of times, such as Stack Smashing Protector. /dev/erandom is also 
     198well suited for any medium security application, and should be used for any 
     199non-cryptographic application instead of /dev/urandom. /dev/erandom will 
     200eventually output repeating data, but can be reinitialized by using 
     201/dev/frandom (dumping one block from /dev/frandom to /dev/null). This is 
     202done automatically after each reboot, and should be done once per week. 
     203 
     204http://www.linuxfromscratch.org/patches/downloads/linux/ 
     205        linux-2.6.21.1-frandom-1.patch 
     206 
     207        CONFIG_FRANDOM is in "Character Devices" and "UserMode" menus. 
     208 
     209Add Udev permissions with the following command: 
     210echo 'NAME=="erandom", MODE="0444" 
     211NAME=="frandom", MODE="0444"' >>/etc/udev/rules.d/25-lfs.rules 
     212 
     213Add this to your crontab, so /dev/erandom will be reinitialized weekly: 
     2140 0 * * 1 /bin/dd if=/dev/frandom of=/dev/null count=1 >/dev/null 2>&1 
     215 
     216Note: The sysctl interfaces are considered obsolete in the latest Linux-2.6 
     217kernels, and may not be supported much longer. As a result the SYSCTL_ERANDOM 
     218interface is no longer recommended, but it's there if you want it. 
     219 
     220- Fortuna kernel driver: 
     221http://jlcooke.ca/random 
     222http://en.wikipedia.org/wiki/Fortuna_(PRNG) 
     223The Fortuna driver is a complete replacement for the Linux random number 
     224driver. While the vanilla kernel uses the SHA1 algorithm, the Fortuna driver 
     225uses AES and SHA-256, and is capable of producing far more volume of random 
     226data from the same entropy, due to using superior algorithms. The Fortuna 
     227driver is also able to use any other algorithms supplied by the Linux crypto 
     228API. The Fortuna driver includes several other improvements to the vanilla 
     229driver. 
     230 
     231At the time of this writing the patch on the Fortuna home page does not build 
     232with linux-2.6.21.1, because of changes to the crypto api. 
     233 
     234        CONFIG_CRYPTO_RANDOM_FORTUNA - This depends on CONFIG_CRYPTO, SHA256, 
     235                                        and AES, in the crypto menu. 
     236 
     237- Arc4random library: 
     238The arc4random interfaces were designed by OpenBSD to solve the problem of 
     239emptying the kernel entropy pool with non-cryptographic applications. In 
     240Linux this is solved with /dev/erandom. The arc4random library function is 
     241a companion function. It is designed to never fail. 
     242 
     243For example, a program can be coded to try to use /dev/urandom for entropy, 
     244and use the gettimeofday library function if /dev/urandom fails (like in a 
     245chroot). The problem with this is that when the gettimeofday function is 
     246being used it is fairly obvious that the output has a sequence, and it tells 
     247an attacker that the system time is being used for entropy in this program. 
     248The arc4random library function also uses /dev/urandom (or /dev/erandom), 
     249and the gettimeofday library function if /dev/urandom fails, except that the 
     250entropy is digested by the arcfour algorithm. The result is that even with a 
     251one microsecond difference from gettimeofday, arc4random's output will be 
     252completely different, and it is impossible for an attacker to know whether 
     253the entropy came from /dev/urandom or the system time. Furthermore, even if 
     254/dev/urandom (or /dev/erandom), and gettimeofday fail, arc4random will use the 
     255uninitialized variables in a large character array (garbage data in memory). 
     256 
     257Many packages will use the arc4random library function if it is found, such as 
     258OpenSSL, OpenSSH, OpenNTPD, and Bind9. 
     259 
     260The arc4random library function discards the first 256 bytes of the stream to 
     261deal with the early key stream weakness, which is described in the paper below. 
     262 
     263This function is included with uClibc. There is a patch below for Glibc. 
    78264 
    79265Read more about Arcfour here: 
    …… 
    84270http://www.wisdom.weizmann.ac.il/~itsik/RC4/Papers/Rc4_ksa.ps 
    85271 
     272This patch adds the arc4random library function, and uses arc4random() in 
     273tempname so it is used by the mktemp() family of functions, instead of 
     274gettimeofday(), and to res_init, res_mkquery, and bindrsvprt to improve the 
     275resolver and port number randomization, instead of using getpid(). 
     276 
     277http://www.linuxfromscratch.org/patches/downloads/glibc/ 
     278        glibc-2.5-arc4_prng-1.patch 
     279 
     280This patch also adds the --with-prng-device option. If you're using 
     281/dev/erandom then use '--with-prng-device=/dev/erandom' when configuring Glibc. 
     282 
     283Install the arc4random.3 manual page with this command: 
     284install -m644 ../glibc-2.5/manual/arc4random.3 /usr/share/man/man3 
     285 
     286OpenSSL will not detect arc4random. If you want to use arc4random with OpenSSL 
     287instead of /dev/urandom then use the following command in OpenSSL's source: 
     288 
     289sed -e 's/__OpenBSD__/__linux__/' -i crypto/rand/rand_unix.c 
     290 
     291This is used with RAND_add, for RAND_bytes and RAND_pseudo_bytes, to re-seed the 
     292random number generator for each thread. 
     293 
    86294- Entropy pool size: 
    87295You can increase the size of your kernel entropy pool. This will help you 
    …… 
    89297current size with: 
    90298cat /proc/sys/kernel/random/poolsize 
    91  
    92 It's usually 512 bytes. The random poolsize can not be reset on the fly like 
    93 it used to because an overflow vulnerability was discovered. Read more here: 
    94 http://www.securityfocus.com/bid/12196/ 
    95  
    96 So if you want to increase the random poolsize you must hard code it in the 
    97 kernel, and reboot the new kernel. 
    98  
    99 Change to your kernel source directory. 
    100  
    101 Replace 512 with 1024 on the line with DEFAULT_POOL_SIZE: 
    102  
    103 sed -e 's/^\(.*DEFAULT_POOL_SIZE.*\) 512/\1 1024/' -i drivers/char/random.c 
    104  
    105 Increase the SECONDARY_POOL_SIZE: 
    106  
    107 sed -e 's/^\(.*SECONDARY_POOL_SIZE.*\) 128/\1 256/' -i drivers/char/random.c 
    108  
    109 And increase BATCH_ENTROPY_SIZE: 
    110  
    111 sed -e 's/^\(.*BATCH_ENTROPY_SIZE.*\) 256/\1 512/' -i drivers/char/random.c 
    112  
    113 These sed command change this: 
    114 #define DEFAULT_POOL_SIZE 512 
    115 #define SECONDARY_POOL_SIZE 128 
    116 #define BATCH_ENTROPY_SIZE 256 
    117  
    118 to this: 
    119 #define DEFAULT_POOL_SIZE 1024 
    120 #define SECONDARY_POOL_SIZE 256 
    121 #define BATCH_ENTROPY_SIZE 512 
    122  
    123 Then compile and install the kernel normally. 
    124  
    125 --- Installations --- 
    126 This software is mirrored here: 
    127 http://blaze.topside.org/~ashes/random/ 
    128  
    129 - Hardware random: 
    130 http://prdownloads.sourceforge.net/gkernel/rng-tools-2.tar.gz?download 
    131  
    132 This is strait forward: 
    133  
    134 ./configure --prefix=/usr && make && make install 
    135  
    136 uClibc does not have argp, because argp is not defined by any standard and 
    137 does not belong in a C library (it's Glibc specific). So get the standalone 
    138 argp library: 
    139 http://www.lysator.liu.se/~nisse/misc/argp-standalone-1.3.tar.gz 
    140  
    141 For uClibc first unpack argp-standalone, we don't need to install this: 
    142  
    143 cd argp-standalone-1.3 && 
    144 ./configure --prefix=/usr && make 
    145  
    146 Then unpack rng-tools: 
    147  
    148 cd rng-tools-2 && 
    149 env LIBS=-largp \ 
    150         CFLAGS="-O2 -L../argp-standalone-1.3 -I../argp-standalone-1.3" \ 
    151         ./configure --prefix=/usr && make && make install 
    152  
    153 My system uses /dev/hw_random, rngd expects to use /dev/hwrandom, so you may 
    154 need to use: 
    155  
    156 rngd -r /dev/hw_random 
    157  
    158 This should be started on boot just like audio-entropyd. 
    159  
    160 - Audio entropy daemon: 
    161 http://www.vanheusden.com/aed/ 
    162 http://www.vanheusden.com/aed/audio-entropyd-0.0.6.tgz 
    163  
    164 make && 
    165 install -g 0 -o 0 -m 755 audio-entropyd /usr/sbin/audio-entropyd 
    166  
    167 Edit your /etc/rc.d/init.d/random and start audio-entropyd just after seeding 
    168 urandom, and stop it just after saving random-seed. Or use the bootscript 
    169 template and make a dedicated bootscript. The PID file will be in /var/run. 
    170 You don't need to reboot to use it, but you do need your sound card driver 
    171 loaded, and be root. Add something like this: 
    172  
    173 if [ -f /usr/sbin/audio-entropyd ] && [ -c /dev/dsp ]; then 
    174         echo "Starting audio entropy daemon..." 
    175         loadproc /usr/sbin/audio-entropyd 
    176 fi 
    177  
    178 and... 
    179  
    180 echo "Stopping audio entropy daemon..." 
    181 killproc /usr/sbin/audio-entropyd 
    182  
    183 - Video entropy daemon: 
    184 http://www.vanheusden.com/ved/ 
    185 http://www.vanheusden.com/ved/video_entropyd-0.7.tgz 
    186  
    187 make && 
    188 install -g 0 -o 0 -m 755 video_entropyd /usr/sbin/video_entropyd 
    189  
    190 Add this to root's crontab every minute or so. It can not run as a daemon 
    191 because it will lock the video device. Depends on video4linux. Using one or 
    192 both of these daemons should be adequate for sustained moderate-to-heavy use. 
    193  
    194 Nothing else needs to be done, applications can continue to use /dev/random 
    195 and /dev/urandom normally. You should notice crypto keys get made faster. 
    196  
    197 - Pseudo random and arc4random: 
    198 Sorry, this has not been backported to older versions yet. 
    199  
    200 http://www.linuxfromscratch.org/patches/downloads/linux/\ 
    201         linux-2.6.10-pseudo_random-1.patch 
    202 http://www.linuxfromscratch.org/patches/downloads/linux/\ 
    203         linux-libc-headers-2.6.10.0-pseudo_random-1.patch 
    204 http://www.linuxfromscratch.org/patches/downloads/linux/\ 
    205         glibc-2.3.4-arc4random-1.patch 
    206 http://www.linuxfromscratch.org/patches/downloads/openssl/\ 
    207         openssl-0.9.7f-arc4random-1.patch 
    208  
    209 You can install this as an upgrade or new LFS installation. 
    210  
    211 cd linux-libc-headers-2.6.10.0 && 
    212 patch -Np1 -i ../linux-libc-headers-2.6.10.0-pseudo_random-1.patch 
    213 ... 
    214  
    215 cd glibc-2.3.4 && 
    216 patch -Np1 -i ../glibc-2.3.4-arc4random-1.patch 
    217 ... 
    218  
    219 Repeat for chapter 6, except add this after Glibc's 'make install'. 
    220  
    221 install -m644 ../glibc-2.3.4/manual/arc4random.3 /usr/share/man/man3 
    222  
    223 This patch adds two menu options, one for sysctl urandom, another for frandom 
    224 character device. They are enabled by default. Frandom must not be a module 
    225 otherwise sysctl will be unable to work. 
    226  
    227 cd linux-2.6.10 && 
    228 patch -Np1 -i ../linux-2.6.10-pseudo_random-1.patch 
    229 ... 
    230 echo "erandom:root:root:0444 
    231 frandom:root:root:0444 
    232 " >> /etc/udev/permissions.d/25-lfs.permissions 
    233  
    234 Then complete LFS installation if necessary and reboot. 
    235  
    236 Add something like this to root's crontab to reseed frandom/erandom every 
    237 Monday: 
    238  
    239 0 0 * * 1 /bin/dd if=/dev/frandom of=/dev/null count=1 >/dev/null 2>&1 
    240  
    241  - Testing entropy 
     299or 
     300sysctl kernel.random.poolsize 
     301 
     302This was recently increased from 512 bytes to 4096 bytes. This /proc file, and 
     303sysctl, is read-only, and can not be changed without hard coding it in the 
     304kernel. 
     305 
     306If you want to increase this then I suggest you use the Grsecurity kernel patch 
     307at: http://www.grsecurity.net/ 
     308 
     309And enable the "Larger entropy pools" option to double the size: 
     310        CONFIG_GRKERNSEC_RANDNET 
     311 
     312- OpenSSL modifications: 
     313OpenSSL command line tools will try to use the $RANDFILE, $HOME/.rnd, or 
     314$(pwd)/.rnd file to initially seed its random number generator. If none are 
     315found then the "PRNG not seeded" error message may occur. We can build OpenSSL 
     316with a contingency plan, to use /dev/urandom, instead of causing an error. 
     317 
     318Do this with the following command in the OpenSSL source: 
     319 
     320sed -e 's/__OpenBSD__/__linux__/' \ 
     321        -e 's/arandom/urandom/' -i crypto/rand/randfile.c 
     322 
     323- Testing entropy quantity 
    242324You should try to test this on an idle machine. Nothing compiling in 
    243325background, no updatedb running, etc. Moving/clicking the mouse, keyboard, and 
    244326even network traffic will create entropy in the pool, and affect results. 
    245 Todo: Have tests for entropy quality, not just quantity. 
    246327 
    247328Fetch this: 
    …… 
    262343refill so quickly. Move the mouse and play with it if you like. If you use a 
    263344small count like count=512 the entropyd program(s) may not refill immediately 
    264 because the pool is still large enough. This is to improve preformance. 
     345because the pool is still large enough. This is to improve performance. 
    265346 
    266347You might want to delete entropy_avail.log when you're done. 
     348 
     349- Testing entropy quality 
     350The 'ent' program runs various tests on data you supply to check for patterns. 
     351For a better description see: 
     352http://www.fourmilab.ch/random/ 
     353 
     354Download the 'ent' program from here: 
     355http://www.fourmilab.ch/random/random.zip 
     356 
     357This package will unpack to your current directory, so it is best to make a 
     358new empty directory and unpack random.zip in there. This package only needs a 
     359'make' command to compile. 
     360 
     361To test your random generators do something like this: 
     362 
     363dd if=/dev/erandom of=erandom.txt count=100 
     364./ent erandom.txt 
     365 
     366or: 
     367 
     368dd if=/dev/erandom count=512|./ent -b 
     369 
     370These tests can take a very long time. 
     371 
     372From the people who made Audio/Video entropy daemon there is another randomness 
     373test program: 
     374http://www.vanheusden.com/Linux/RNGTEST.tgz 
     375 
     376To compile RNGTEST: 
     377 
     378gcc -o RNGTEST RNGTEST.c 
     379 
     380To use RNGTEST: 
     381 
     382dd if=/dev/frandom count=2048 | RNGTEST 
     383and: 
     384cat /bin/true | RNGTEST 
     385 
     386You'll notice /bin/true fails the RNGTEST multiple times. 
    267387 
    268388ACKNOWLEDGMENTS: 
    …… 
    306426* Added patch for OpenSSL. 
    307427[2005-04-04] 
    308 * Update the kernel random poolsize modifcation method. This must be hardcoded 
     428* Update the kernel random poolsize modification method. This must be hard coded 
    309429  now. 
    310430[2005-04-09] 
    311431* Add argp standalone library so rng-tools will build on uClibc. 
     432[2007-05-16] 
     433* Updated the description. 
     434* Added Fortuna kernel driver. 
     435* Added some OpenSSL additions. 
     436* Updated arc4random Glibc patch. 
     437* Updated Frandom kernel patch. 
     438* Added table of contents. 
     439* Added entropy quality tests. 
     440* Fixed the Udev config thanks to Bryan Kadzban.