8

I've read the raspberry pi zero ships with an integrated hardware random number generator. I've followed some instructions on how to activate the hwrng, but how do I know the system is actually using it? It doesn't seem to appear in the output of lsmod:

Module                  Size  Used by
sg                     20799  0 
evdev                  11650  2 
snd_bcm2835            23131  0 
snd_pcm                95473  1 snd_bcm2835
snd_timer              22556  1 snd_pcm
snd                    68400  3 snd_bcm2835,snd_timer,snd_pcm
bcm2835_gpiomem         3823  0 
bcm2835_wdt             4133  0 
uio_pdrv_genirq         3718  0 
uio                    10230  1 uio_pdrv_genirq
ipv6                  367671  18

If the hwrng is being used by the system, where is it being used? /dev/random?

Bonus question, how much entropy is enough? Here's what's in my entropy_avail file:

$ cat /proc/sys/kernel/random/entropy_avail
2048

Thanks in advance for the help!

Improve this question
1
  • Can you not just cat /dev/hwrng and if it outputs something, then it's working, right? It's different from the other rngs because I think it comes from a dedicated HW Rng. Anyone know what?
    – Owl
    Commented Aug 27, 2019 at 13:50

1 Answer 1

Reset to default
9

Install the package rng-tools:

sudo apt-get install rng-tools

this will install rngd, which gets entropy from /dev/hwrng and feeds it to /dev/random where it is mixed into the kernel's entropy pool. rngd will run interal tests on the apparent randomness of the hardware rng and output them to syslog - you can force this to happen by sending signal USR1, like this:

sudo kill -USR1 `cat /var/run/rngd.pid`

then look in /var/log/daemon.log for the output:

sudo grep rngd /var/log/daemon.log

and you should see something like this:

Apr 14 12:04:26 raspberrypi rngd[506]: stats: bits received from HRNG source: 60064
Apr 14 12:04:26 raspberrypi rngd[506]: stats: bits sent to kernel pool: 16896
Apr 14 12:04:26 raspberrypi rngd[506]: stats: entropy added to kernel pool: 16896
Apr 14 12:04:26 raspberrypi rngd[506]: stats: FIPS 140-2 successes: 3
Apr 14 12:04:26 raspberrypi rngd[506]: stats: FIPS 140-2 failures: 0
Apr 14 12:04:26 raspberrypi rngd[506]: stats: FIPS 140-2(2001-10-10) Monobit: 0
Apr 14 12:04:26 raspberrypi rngd[506]: stats: FIPS 140-2(2001-10-10) Poker: 0
Apr 14 12:04:26 raspberrypi rngd[506]: stats: FIPS 140-2(2001-10-10) Runs: 0
Apr 14 12:04:26 raspberrypi rngd[506]: stats: FIPS 140-2(2001-10-10) Long run: 0
Apr 14 12:04:26 raspberrypi rngd[506]: stats: FIPS 140-2(2001-10-10) Continuous run: 0
Apr 14 12:04:26 raspberrypi rngd[506]: stats: HRNG source speed: (min=652.979; avg=837.341; max=976.221)Kibits/s
Apr 14 12:04:26 raspberrypi rngd[506]: stats: FIPS tests speed: (min=12.810; avg=13.031; max=13.489)Mibits/s
Apr 14 12:04:26 raspberrypi rngd[506]: stats: Lowest ready-buffers level: 2
Apr 14 12:04:26 raspberrypi rngd[506]: stats: Entropy starvations: 0
Apr 14 12:04:26 raspberrypi rngd[506]: stats: Time spent starving for entropy: (min=0; avg=0.000; max=0)us

An occasional failure of the FIPS-140 tests is nothing to worry about.

Improve this answer
1
  • Note that you should be even be a bit suspicious if it always passes the tests. A sequence of x 0-bits is just as likely as any other combination of x bits but it will certainly fail the tests.
    – Garo
    Commented Jan 6, 2023 at 16:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.