* RNG algo question
@ 2016-09-16 21:33 Palmer, Thomas
2016-09-17 7:19 ` Ard Biesheuvel
0 siblings, 1 reply; 3+ messages in thread
From: Palmer, Thomas @ 2016-09-16 21:33 UTC (permalink / raw)
To: edk2-devel@lists.01.org; +Cc: Gibbons, Pat
EDK2 community
Why is the RngGetRNG sending requests for "gEfiRngAlgorithmRaw" to "RdRandGenerateEntropy", which does AES operations on RDRAND output, whereas the requests for "gEfiRngAlgorithmSp80090Ctr256Guid" get sent to RdRandGetBytes which simply reads the rdrand source without modification.
Shouldn't the processing be switched, so that "Raw" goes to RdRandGetBytes and "gEfiRngAlgorithmSp80090Ctr256Guid" goes to RdRandGenerateEntropy? I did not see anything in the UEFI 2.5 spec indicating why this was the case.
Regards,
Thomas Palmer
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: RNG algo question
2016-09-16 21:33 RNG algo question Palmer, Thomas
@ 2016-09-17 7:19 ` Ard Biesheuvel
2016-09-17 16:46 ` Long, Qin
0 siblings, 1 reply; 3+ messages in thread
From: Ard Biesheuvel @ 2016-09-17 7:19 UTC (permalink / raw)
To: Palmer, Thomas; +Cc: edk2-devel@lists.01.org, Gibbons, Pat
On 16 September 2016 at 22:33, Palmer, Thomas <thomas.palmer@hpe.com> wrote:
>
> EDK2 community
>
> Why is the RngGetRNG sending requests for "gEfiRngAlgorithmRaw" to "RdRandGenerateEntropy", which does AES operations on RDRAND output, whereas the requests for "gEfiRngAlgorithmSp80090Ctr256Guid" get sent to RdRandGetBytes which simply reads the rdrand source without modification.
>
> Shouldn't the processing be switched, so that "Raw" goes to RdRandGetBytes and "gEfiRngAlgorithmSp80090Ctr256Guid" goes to RdRandGenerateEntropy? I did not see anything in the UEFI 2.5 spec indicating why this was the case.
>
The RDRAND instruction does not give you raw entropy, but the output
of a DRBG. So the 'raw' entropy is being emulated by taking multiple
rounds of RDRAND output and shuffling it around to make it 'raw'
>From the top of RngDxe.c:
RNG Algoritnms defined in UEFI 2.4:
- EFI_RNG_ALGORITHM_SP800_90_CTR_256_GUID - Supported
(RDRAND implements a hardware NIST SP800-90 AES-CTR-256 based DRBG)
- EFI_RNG_ALGORITHM_RAW - Supported
(Structuring RDRAND invocation can be guaranteed as high-quality
entropy source)
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: RNG algo question
2016-09-17 7:19 ` Ard Biesheuvel
@ 2016-09-17 16:46 ` Long, Qin
0 siblings, 0 replies; 3+ messages in thread
From: Long, Qin @ 2016-09-17 16:46 UTC (permalink / raw)
To: Ard Biesheuvel, Palmer, Thomas; +Cc: edk2-devel@lists.01.org, Gibbons, Pat
Exactly. Thanks, Ard.
gEfiRngAlgorithmRaw is designed to provide entropy directly (defined in UEFI spec), which is intended to use the DRNG to seed in an ongoing manner some current software PRNG. Though RDRAND is quite usable as a source of random values. For standards compliance, some may feel it necessary to demand an absolute guarantee that values returned by RDRAND reflect independent entropy samples within the DRNG. One choice is to use RdSeed instruction directly. The current implementation leverage the reseeding guarantee of the DRBG to generate random seeds from values obtained via RDRAND (for the processor that do not support the RDSEED).
For gEfiRngAlgorithmSp80090Ctr256Guid, the current RdRand output is already compliant with NIST SP800-90C standards.
More information can be referred from https://software.intel.com/en-us/articles/intel-digital-random-number-generator-drng-software-implementation-guide
Best Regards & Thanks,
LONG, Qin
-----Original Message-----
From: edk2-devel [mailto:edk2-devel-bounces@lists.01.org] On Behalf Of Ard Biesheuvel
Sent: Saturday, September 17, 2016 3:19 PM
To: Palmer, Thomas <thomas.palmer@hpe.com>
Cc: edk2-devel@lists.01.org; Gibbons, Pat <pat.gibbons@hpe.com>
Subject: Re: [edk2] RNG algo question
On 16 September 2016 at 22:33, Palmer, Thomas <thomas.palmer@hpe.com> wrote:
>
> EDK2 community
>
> Why is the RngGetRNG sending requests for "gEfiRngAlgorithmRaw" to "RdRandGenerateEntropy", which does AES operations on RDRAND output, whereas the requests for "gEfiRngAlgorithmSp80090Ctr256Guid" get sent to RdRandGetBytes which simply reads the rdrand source without modification.
>
> Shouldn't the processing be switched, so that "Raw" goes to RdRandGetBytes and "gEfiRngAlgorithmSp80090Ctr256Guid" goes to RdRandGenerateEntropy? I did not see anything in the UEFI 2.5 spec indicating why this was the case.
>
The RDRAND instruction does not give you raw entropy, but the output of a DRBG. So the 'raw' entropy is being emulated by taking multiple rounds of RDRAND output and shuffling it around to make it 'raw'
>From the top of RngDxe.c:
RNG Algoritnms defined in UEFI 2.4:
- EFI_RNG_ALGORITHM_SP800_90_CTR_256_GUID - Supported
(RDRAND implements a hardware NIST SP800-90 AES-CTR-256 based DRBG)
- EFI_RNG_ALGORITHM_RAW - Supported
(Structuring RDRAND invocation can be guaranteed as high-quality entropy source) _______________________________________________
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2016-09-17 16:46 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2016-09-16 21:33 RNG algo question Palmer, Thomas
2016-09-17 7:19 ` Ard Biesheuvel
2016-09-17 16:46 ` Long, Qin
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox