10000 device.c - add support for /dev/hwrng instead of /dev/urandom · Issue #219 · solokeys/solo1 · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

device.c - add support for /dev/hwrng instead of /dev/urandom #219

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
alphathegeek opened this issue Jul 8, 2019 · 4 comments
Closed

device.c - add support for /dev/hwrng instead of /dev/urandom #219

alphathegeek opened this issue Jul 8, 2019 · 4 comments

Comments

@alphathegeek
Copy link

consider adding another parameter for RNG support, or checking if the developement platform has HWRNG support.

I use /dev/hidg0 on my Raspberry Pi for SoloKey Development, and since the Pi has a HW RNG, I'd like to use that as the RNG.

I patched "device.c" to use /dev/hwrng, instead of "/dev/urandom".
@nickray
Copy link
Member
nickray commented Jul 8, 2019 •
edited
Loading

Thanks for bringing this up! Not being familiar with Raspberry Pis myself, do you have any evidence that urandom does not use the hwrng appropriately?

"Generally" (this is discussed all over the internet, e.g. https://www.2uo.de/myths-about-urandom/), Linux does "the right thing" to makeurandom the best possible (general purpose) CSPRNG on a given platform. So in this situation, I'd assume it uses hwrng, but possibly even more entropy sources. So in some sense, using hwrng directly might even be worse 😜.

Pull requests are certainly always welcome, in this case you just got me interested!

@nickray
Copy link
Member
nickray commented Jul 8, 2019

BTW, you may also be interested in #154, as there's a school of thought that distrusts blackbox embedded HWRNGs. Besides tests for "obvious" non-randomness, it seems quite hard to detect malfunctions and generally rate the quality of entropy sources.

@alphathegeek
Copy link
Author

Good point. I do run "rngd" which supposedly ensures that urandom is seeded with a number of entropy sources, /dev/hwrng being one of them. So in that case, using /dev/urandom is probably the better option.

As an aside, I have a dedicated raspberry pi providing a source of randomness to the desktop PC, since the desktop uses another "black box" HWRNG provided by Intel, which I trust wayyy less.

The Pi Serves as my DIY "Solo-Hacker". About all the same issues as a "hacker" but without the ability to lock the bootloader, great for tooling around with though.

@alphathegeek
Copy link
Author

I'd suggest closing this, since running on raspberrypi-zero is probably a corner case, and rngd confirmed running, so source of randomness is ok.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@nickray @alphathegeek
0