This then piqued my interest as I've recently been involved with looking into FIPS compliance, and in my vm environment /dev/urandom compliance testing generates data like this:
[admin@xxx~]$ cat /dev/urandom | rngtest -c 5000 rngtest 2 Copyright (c) 2004 by Henrique de Moraes Holschuh This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. rngtest: starting FIPS tests... rngtest: bits received from input: 100000032 rngtest: FIPS 140-2 successes: 4998 rngtest: FIPS 140-2 failures: 2 rngtest: FIPS 140-2(2001-10-10) Monobit: 0 rngtest: FIPS 140-2(2001-10-10) Poker: 0 rngtest: FIPS 140-2(2001-10-10) Runs: 1 rngtest: FIPS 140-2(2001-10-10) Long run: 1 rngtest: FIPS 140-2(2001-10-10) Continuous run: 0 rngtest: input channel speed: (min=2.210; avg=63.902; max=19073.486)Mibits/s rngtest: FIPS tests speed: (min=2.477; avg=123.448; max=157.632)Mibits/s rngtest: Program run time: 2277143 microseconds
The thing missing from these questions, is how bad is bad? Do we have firm numbers that dictate statistical compliance?
How badly does moving to a virtual machine harm entropy?