RDRAND: Difference between revisions
No edit summary |
|||
| (3 intermediate revisions by the same user not shown) | |||
| Line 1: | Line 1: | ||
[[File:Rdrand.jpeg|right|thumb|IDF 2011 RDRAND slide]] | |||
RDRAND is an instruction available on Intel processors for which [[CPUID]] sets bit 30 of the ECX register high (starting with [[Ivy Bridge]]). It is available at all privilege levels, and generates 16-, 32- or 64-bit random integer values (64-bit only in long mode). Its single operand is the (general-purpose) destination register. It sets the CF bit of [[EFLAGS]] to 1 if the destination register has been successfully set. Bull Mountain (the DRNG hardware + RDRAND instruction) is said to leverage "[[Standards#Cryptography|NIST SP800-90, FIPS-140-2, and ANSI X9.82]]." The Bull Mountain hardware is [[SMP on x86|per-processor package]]. H. Peter Anvin [http://thread.gmane.org/gmane.linux.kernel/1173350 added support] to the Linux kernel 2011-07-29. It is [http://www.spinics.net/lists/linux-crypto/msg05883.html expected] to soon be used by [[OpenSSL]]. | RDRAND is an instruction available on Intel processors for which [[CPUID]] sets bit 30 of the ECX register high (starting with [[Ivy Bridge]]). It is available at all privilege levels, and generates 16-, 32- or 64-bit random integer values (64-bit only in long mode). Its single operand is the (general-purpose) destination register. It sets the CF bit of [[EFLAGS]] to 1 if the destination register has been successfully set. Bull Mountain (the DRNG hardware + RDRAND instruction) is said to leverage "[[Standards#Cryptography|NIST SP800-90, FIPS-140-2, and ANSI X9.82]]." The Bull Mountain hardware is [[SMP on x86|per-processor package]]. H. Peter Anvin [http://thread.gmane.org/gmane.linux.kernel/1173350 added support] to the Linux kernel 2011-07-29. It is [http://www.spinics.net/lists/linux-crypto/msg05883.html expected] to soon be used by [[OpenSSL]]. | ||
| Line 8: | Line 9: | ||
** Each seed requires at least two healthy values (per-sample result) | ** Each seed requires at least two healthy values (per-sample result) | ||
** "In the rare event a DRNG fails at runtime, it will cease to issue random numbers" | ** "In the rare event a DRNG fails at runtime, it will cease to issue random numbers" | ||
*** There seems no way to detect this situation save executing RDRAND and seeing CF unset. | |||
* "Built-in Self Tests" | * "Built-in Self Tests" | ||
** DRNG is run for 256 samples of OHT validation before being made available to software | ** DRNG is run for 256 samples of OHT validation before being made available to software | ||
** OHT is provided known-bad data and must identify it as "unhealthy" | ** OHT is provided known-bad data and must identify it as "unhealthy" | ||
** Deterministic values are played through the conditioner, and results are verified | ** Deterministic values are played through the conditioner, and results are verified | ||
==Limitations== | ==Limitations== | ||
"The one use case that it is cryptographically insufficient for is to seed a new PRNG, which probably means it is unsuitable for being fed as-is into /dev/random." - [http://www.spinics.net/lists/linux-crypto/msg05883.html H. Peter Anvin], 2011-06-14 | "The one use case that it is cryptographically insufficient for is to seed a new PRNG, which probably means it is unsuitable for being fed as-is into /dev/random." - [http://www.spinics.net/lists/linux-crypto/msg05883.html H. Peter Anvin], 2011-06-14 | ||
==See Also== | ==See Also== | ||
* Intel's [http://software.intel.com/en-us/articles/download-the-latest-bull-mountain-software-implementation-guide/ Bull Mountain Software Implementation Guide] | * Intel's [http://software.intel.com/en-us/articles/download-the-latest-bull-mountain-software-implementation-guide/ Bull Mountain Software Implementation Guide] | ||
== | * IEEE Spectrum's September 2011 article, [http://spectrum.ieee.org/computing/hardware/behind-intels-new-randomnumber-generator "Behind Intel's New Random-Number Generator"] | ||
==Corrections== | |||
* David Johnston of Intel corrected me on 2011-09-15: "RDRAND is not an [[AVX]] instruction. It is a normal instruction." Thanks, David! | * David Johnston of Intel corrected me on 2011-09-15: "RDRAND is not an [[AVX]] instruction. It is a normal instruction." Thanks, David! | ||
[[CATEGORY: X86]] | [[CATEGORY: X86]] | ||