4

Currently I am using haveged on my server as source of entropy.

My Server is used as KVM hypervisor, to run virtual machines.

I did not use haveged at the beginning, and I noticed the VMs were draining the entropy pool from the server. Sometimes, when VMs were started SSH waited for enough entropy (to generate session keys, I guess).

Now with haveged, I don't have this problem anymore.

But I would like to try to use a HW random number generator. I am not saying haveged is bad, but true HW random number generator can only make the entropy better. I have seen some HW RNG which work on basis of Geiger counter, some which collect noise from microphone, and so on.

Which are most reasonable to use ? Could somebody perhaps recommend some specific one ?

Ideally, I would like it to be connected over serial port. Second best would be over USB.

Improve this question
2
  • Doesn't the processor on your host have a random generator built in (RDRAND)?
    – Gilles 'SO- stop being evil'
    Commented Nov 12, 2019 at 17:32
  • @Gilles 'SO- stop being evil' - I think the processor has RNG, but linux does not use it.
    – Martin Vegter
    Commented Nov 13, 2019 at 1:43

1 Answer 1

Reset to default
-1

Haveged has already been contested and does not guarantee TRNG.

You should get a hardware certified device like QRNG . It is a certified device and has passed many compliance tests including NIST SP800-22.

You can also find an USB stick device which claims it passes tests like Dieharder, ENT, Rngtest, FIPS-140-2.

These 2 should definitely be better than Haveged.

Other things you mentioned like Geiger or noise are also determinable/predictable.

Improve this answer
4
  • 2
    "Geiger or noise are also determinable/predictable." I would like to know how Geiger is predictable.For noise, it depends on what kind of system you're imagining.
    – Future Security
    Commented Nov 12, 2019 at 16:00
  • Sources used like an Americium 241 pellet have very determinable output. Unless you work in a lab with hundreds of different sources, you will be able to determine a Geiger's response.
    – Overmind
    Commented Nov 13, 2019 at 8:04
  • Citation needed on your claims about haveged (not in VMs) and Geiger counters.
    – A. Hersean
    Commented Nov 13, 2019 at 13:21
  • You may be able to determine the general rate of decay, but it is fundamentally impossible to predict a (sensitive) Geiger's response with sufficient precision to make it useless as an entropy source.
    – forest
    Commented Nov 17, 2019 at 23:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .