The CPU Jitter Random Number Generator provides a non-physical true random number generator that works equally in kernel and user land. The only prerequisite is the availability of a high-resolution timer that is available in modern CPUs.
A public git repository of the Jitter-RNG core is found at smuellerDD/jitterentropy-library.
A public git repository of an RNGd based on the Jitter-RNG usable for Linux is found at smuellerDD/jitterentropy-rngd.
A PDF documentation is also available. The pictures and graphs are better to read in the PDF version.
The PDF documentation for the Jitter RNG 2.2.0 is applicable for the current versions of the Linux kernel.
I am looking for CPUs that are not listed in appendix F of the documentation. If you happen to have such a CPU with a Unix-ish operating system and you want to help me to gather more evidence on the appropriateness of the CPU Jitter random number generator, please perform the following:
The following source code contains the implementation of the CPU Random Number Generator.
Link | Changes |
---|---|
20130508 | Initial version |
20130516 |
Small enhancement of Kernel DRNG support -- making the reseeding and rekeying implementation more robust for edge conditions Compile the CPU Jitter RNG as stand-alone shared library Addition of OpenSSL engine support |
20130521 |
Moving of code parts relevant to different consumer into sub directories OpenSSL: add jitterentropy-drng and jitterentropy-strong engines |
20130617 |
Adding test to assess entropy of timer over folding loop -- test results in section 5.1 and appendix F added to documentation Update jent_entropy_init to check for coarse timers Add patch to integrate CPU Jitter RNG as entropy of last resort into /dev/random and /dev/urandom -- see appendix B.3 |
20130621 |
Adding more test to assess entropy of timer over folding loop -- test results in appendix F added to documentation Bug fix in jent_entropy_init Add code in arch/ and android/ directories for non-Linux environments |
20130626 |
Adding more test to assess entropy of timer over folding loop -- test results in appendix F added to documentation Bug fix in jent_entropy_init |
20130724 |
Adding more test to assess entropy of timer over folding loop -- test results in appendix F added to documentation (there are now 197 different tests) Remove statistical tests in jent_entropy_init that cause ambiguous results Add support for MacOS and AIX in jent_get_nstime |
20130806 |
Addition of z/OS test code and description in arch/zOS |
20130818 |
Added missing -O0 to /dev/random patch Fix bug in output of random data: mixed bit and byte representation |
20130910 |
Adding of jitterentropy-rngd -- an entropy feeder daemon to add entropy to /dev/random's input_pool from user space (see appendix E) Use of Linux kernel clocksource if get_cycles return zero Documentation: adding section 4.5 to discuss Von Neumann De-Skew |
20130912 |
Replace varying entropy loop counter with Von Neumann unbias operating. This implies that the analysis of the entropy loop counter statistics in chapter 4 are removed. The impact of the Von Neumann unbias operation on the entropy is discussed in chapter 5. |
20130930 |
Allow caller of jent_entropy_collector_alloc to specify an oversampling rate. That rate determines whether the folding loop is executed in multiple instances to implement an oversampling of the individual bits. Add test results for microkernels. Add analysis of change of CPU execution jitter over time in section 5.1.1. Add analysis of the impact of disabling certain system characteristics on CPU execution jitter in appendix F.43. |
20131020 |
Addition of non-cryptographic whitening function that can be enabled during allocation time. Addition of tests on Windows 7 |
20131028 |
Add add_jent_randomness call to initialization of entropy pools in random.c. Update structure of Linux kernel Makefile to allow seamless integration into kernel Addition of tests on Samsung Galaxy S4 |
20131113 |
Add JENT_DISABLE_UNBIAS flag to allocation function to disable Von-Neumann unbias. Add test to verify presence of CPU execution time jitter on bare metal (test_baremetal/) Document baremetal testing by adding new chapter 6 Add folding test result for Intel Core i7 IvyBridge |
20140131 |
Addition of new noise source: memory access which adds significant additional entropy Rewrite of bare metal test to include memory access testing and more CPU execution jitter testing Chapter 6 of the documentation completely rewritten to cover an in-depth analysis of the noise sources, including a rationale of the theory of root cause of memory access variations Update Linux kernel patch for 3.13 and to feed the input_pool only |
20140219 |
Add PID file to jitterentropy-rngd -- thanks to Jan Blunck Fix wrapping logic in memaccess loop -- thanks to Jan Blunck Fix NULL pointer dereference in jent_entropy_collector_free |
20140220 |
Bug fix for wrap calculation in memaccess loop -- thanks to Mikko Loytynoja |
20140402 |
jitterentropy-rngd: compile without JENT_DISABLE_MEMORY_ACCESS to protect state in case of swap-out, crash dumps, etc FIPS mode: read /proc/sys/crypto/fips_enabled |
The shuffling function that selects the new number of folding loop is now more balanced jitterentropy-rngd: make a separate package |
|
The number of memory accesses is now shuffled the same way as the folding loop: For each memory access noise request, a time stamp determines a number between 64 and 192 for the memory accesses |
|
start new numbering schema update processing of bit that is deemed holding no entropy by heuristic: XOR it into pool without LFSR and bit rotation (reported and suggested by Kevin Fowler) |
|
mark function jentrng_versionstring static (thanks to Kevin Fowler) use errno with strerror (thanks to Kevin Fowler) compile with -pedantic and make appropriate code changes |
|
change jitterentropy.service: move RNGd startup up the boot ladder to allow all cryptographic services to benefit from a RNGd-updated /dev/?random |
|
jent_stir_pool is now a constant time function to prevent leaking timing information about the random number. Make it compile on 32 bit architectures. |
|
Ensure that the buffer holding entropy data is zeroized immediately after use. |
|
Jitterentropy: Replace the XOR folding of a time delta with an LFSR -- the use of an LFSR is mathematically more sound for the argument to maintain entropy rngd: inject only 32 bytes of entropy of entropy instead of 256 bytes rngd: apply oversampling factor -- i.e. obtain OVERSAMPLINGFACTOR bytes more from Jitter RNG than required for the 32 bytes of entropic data rngd: do not install sig_alarm handler if the LRNG is present rngd: Use Jitter RNG logic v2.0.0 |
|
Jitterentropy: Invcation of stuck test during initalization rngd: inject 32 bytes of entropy into /dev/random before daemonizing as suggested by Pascal de Bruijn rngd: add jitterentropy-rngd.1 man page as suggested by Pascal de Bruijn rngd: mall changes to systemd unit file suggested by Pascal de Bruijn |
|
Include jitterentropy core 2.0.1 Compile jitterentropy core without optimizations using GCC pragmas instead of -O0 as suggested by Paul Wouters Change CFLAGS and LDFLAGS from += to ?= to allow smooth integration with build environment as suggested by Paul Wouters Version information now can obtained as unprivileged user |
|
Convert all __[u|s][32|64] into [uint|int][32|64]_t Remove all code protected by #if defined(__KERNEL__) && !defined(MODULE) Add JENT_PRIVATE_COMPILE: Enable flag during compile when compiling a private copy of the Jitter RNG Remove unused statistical test code Add FIPS 140-2 continuous self test code threshold for init-time stuck test configurable with JENT_STUCK_INIT_THRES during compile time |
|
Fix implementation of mathematical properties. |
|
Include jitterentropy core 2.1.1 (note, RNGD version 1.0.7 is broken) |
|
Add static library compilation thanks to Neil Horman Initialize variable ec to satisfy valgrind as suggested by Steve Grubb Add cross-compilation support suggested by Lonnie Abelbeck |
|
Jitterentropy library 2.2.0 (Signature) Jitterentropy SP800-90B test code |
SP800-90B compliance Add full SP800-90B compliance. The documentation now contains a full SP800-90B compliance assessment. The test code includes all necessary tests for achieving SP800-90B compliance on a specific target platform. RNGD: fix race conditions around signal handling RNGD: import SP800-90B compliant Jitter RNG |
Jitterentropy library 3.0.0 (Signature) Jitterentropy SP800-90B test code |
SP800-90B compliance library: use RDTSC on x86 directly instead of clock_gettime library: use SHA-3 instead of LFSR library: add internal high-resolution timer support RNGD: use jitterentropy library version 3.0.0 RNGD: Due to the removal of the blocking pool in kernel 5.6, it is becoming very unlikely that the user space rngd is ever triggered by the kernel. Thus, the jitterentropy-rngd now injects entropy every 10 minutes unconditionally. RNGD: Use the RNDRESEEDCRNG ioctl after injecting entropy to guarantee that the new entropy is immediately forwarded to the ChaCha20 DRNG. Otherwise the ChaCha20 DRNG will not benefit from the new entropy up to 5 minutes after the injection of the entropy. |
Jitterentropy library 3.0.1 (Signature) |
SP800-90B compliance library: on older GCC versions use -fstack-protector as suggested by Warszawski, Diego library: prevent creating the internal timer thread if a high-res hardware timer is found as reported by Lonnie Abelbeck RNGD: on older GCC versions use -fstack-protector as suggested by Warszawski, Diego RNGD: prevent creating the internal timer thread if a high-res hardware timer is found as reported by Lonnie Abelbeck RNGD: disable RNDRESEEDCRNG on kernels < 4.17 as suggested by Warszawski, Diego RNGD: Use Jitter RNG library 3.0.1 |