Given all the OpenSSH/Diffie-Hellman issues seen lately, I was regenerating all my certs to longer ones, which on the RPi is a bit of a job. Afterwards I discovered that the RPi actually has a hardware RNG. To make use if this awesome tool:
Install the kernel module
sudo modprobe bcm2708-rng
Make sure it is always available by adding it to /etc/modules
bcm2708-rng
Install some cool RNG tools.
sudo apt-get install rng-tools
The hardware device should now be available to root as /dev/hwrng
Testing how random is random
We have the basic rngtest available to use courtesy of rng-tools – there are far harsher ones e.g. dieharder but they take a while to run. Testing for true randomness is quite hard – you need a vast number of tests, and even then we would expect a few failed tests for truly random input.
In this case I had 2 failed tests out of 1000, which is reasonable.
sudo cat /dev/hwrng | rngtest -c 1000 rngtest 2-unofficial-mt.14 Copyright (c) 2004 by Henrique de Moraes Holschuh This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. rngtest: starting FIPS tests... rngtest: bits received from input: 20000032 rngtest: FIPS 140-2 successes: 998 rngtest: FIPS 140-2 failures: 2 rngtest: FIPS 140-2(2001-10-10) Monobit: 0 rngtest: FIPS 140-2(2001-10-10) Poker: 0 rngtest: FIPS 140-2(2001-10-10) Runs: 1 rngtest: FIPS 140-2(2001-10-10) Long run: 1 rngtest: FIPS 140-2(2001-10-10) Continuous run: 0 rngtest: input channel speed: (min=35.153; avg=859.670; max=1627604.167)Kibits/s rngtest: FIPS tests speed: (min=401.935; avg=3276.347; max=7317.816)Kibits/s rngtest: Program run time: 29046630 microseconds
In comparison with the linux /dev/random number generator it’s not bad at all. The linux /dev/random passed all the tests but took far longer – look at the difference between the input channel speed 233.256kibits/s vs. 859.670kibits/s.
sudo cat /dev/random | rngtest -c 1000 rngtest 2-unofficial-mt.14 Copyright (c) 2004 by Henrique de Moraes Holschuh This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. rngtest: starting FIPS tests... rngtest: bits received from input: 20000032 rngtest: FIPS 140-2 successes: 1000 rngtest: FIPS 140-2 failures: 0 rngtest: FIPS 140-2(2001-10-10) Monobit: 0 rngtest: FIPS 140-2(2001-10-10) Poker: 0 rngtest: FIPS 140-2(2001-10-10) Runs: 0 rngtest: FIPS 140-2(2001-10-10) Long run: 0 rngtest: FIPS 140-2(2001-10-10) Continuous run: 0 rngtest: input channel speed: (min=97.034; avg=233.256; max=428.947)Kibits/s rngtest: FIPS tests speed: (min=836.349; avg=5252.286; max=7274.209)Kibits/s rngtest: Program run time: 87562313 microseconds
