Penetration Test Report (Cryptography Research): VIA rngsum

E S :
VALUATION UMMARY
VIA C3 N R N G
EHEMIAH ANDOM UMBER ENERATOR
Cryptography Research performed an evaluation of the hardware-based random number
generator (RNG) in the VIA Technologies C3 Nehemiah core. This document summarizes
findings from the technical report prepared for VIA Technologies.
Background RNG Design
Randomness is required for a variety of computational, The RNG contains a raw bit generator, digital post-
statistical, and security-related applications. In processing circuitry, and an interface accessible by a
particular, cryptographic applications rely on special-purpose instruction. This section contains a
randomness to generate keys, produce unpredictable brief description of the Nehemiah RNG source based on
challenge values, create padding bytes, and derive other operational modes recommended by Cryptography
security-critical parameters. Almost all security Research.
protocols rely on sources of randomness, and random
number generator flaws are a common security Raw bit generator. A collection of freewheeling
problem. oscillators serves as an entropy source. A slow
freewheeling oscillator (~30 MHz) is utilized to sample
Most computers are completely deterministic in the output of a fast freewheeling oscillator (~600 MHz).
operation, and therefore lack convenient sources of The jitter of the slow oscillator is further increased by
randomness. As a result, developers of security adjusting the oscillator’s bias voltage with output from
software rely on software-based pseudo-random two additional fast oscillators. Thermal noise,
number generators (PRNGs). These generators collect manufacturing variations, temperature, software
“seed” data from unpredictable system activity, settings, and local electrical conditions are expected to
including keystrokes, mouse activity, and process contribute entropy to the sampled output.
timings. Although PRNG output is not truly random,
properly-seeded PRNGs can generate sufficiently Digital post-processing . Pairs of bits in the sampled
unpredictable output for most
applications. Seeding, however, is
generally a slow process involving C5XL Entropy Source Design
user involvement, creating testing
challenges and difficulties in Ring Oscillators A,B,C
automated environments. 450-810 MHz Sampling
Flip Flop
Shift
The VIA Technologies C3 C von Neumann Register
Corrector
Nehemiah core incorporates a
Bias Setting
_.
hardware-based random number .8 Raw Mode
B Select
generator (RNG). This feature can Bias V
XOR
Generator 1 bit
produce high-entropy output at _. discard
fast bit rates. This document .8 D
A Ring Oscillator D
summarizes results from our 20-68 MHz
testing of the RNG. Byte to
FIFO
Figure 1: Nehemiah entropy source design.
Information in this summary is provided without guarantee or warranty of any kind. This review was performed for VIA
Technologies, Inc. but represents the findings and opinions of Cryptography Research, Inc. and may or may not reflect
opinions of VIA Technologies, Inc. or Centaur Technology. Characteristics of the C3 Nehemiah may vary with design
or implementation changes. Cryptography Research provided no Nehemiah design assistance to VIA Technologies
or Centaur Technology. Copyright © 2003 Cryptography Research, Inc. www.cryptography.com
EVALUATION SUMMARY: VIA C3 NEHEMIAH RNG
output are passed through a von Neumann whitener,
which reduces (but does not completely remove) single-
bit biases from the sampled data.1 Whitened bits are
then accumulated in a FIFO containing four 8-byte
buffers (32 bytes total). To save power, the raw source
oscillators are automatically shut down when the FIFO
is full.
Data requests. User code may retrieve the contents of
one 8-byte buffer at a time via the extended x86
XSTORE instruction. Each XSTORE operation either
consumes 8 bytes (one buffer), or returns no data if no
full buffer is available. The XSTORE instruction also
copies the RNG configuration registers to user space,
allowing applications to verify the exact RNG state at
the time of the XTORE call.
Additional modes. The RNG contains advanced
configuration settings that may be used by researchers
and advanced users.2 Ring 0 (operating system) code
can adjust the oscillator bias voltage, and can optionally
disactivate the von Neumann corrector for testing
purposes. Other modes include a string filter and a 1-
of-N bit discarder. The configuration settings are
returned with each data request so that applications can
ensure that the configuration is acceptable.
Figure 2: Serial correlations diminish more quickly
Summary of Evaluation Results
when the von Neumann whitener is enabled
Testing procedures. Multiple processors were tested in
a range of environmental conditions, oscillator output bit. When used at the recommended settings, it
stop/start usage patterns, and conditions found in multi- should be reasonable to assume that the RNG provides
application environments. The Nehemiah core allows 0.75 bits of entropy per output bit.3 Note that our
direct access to the raw (unwhitened) bit generator recommendations have been chosen conservatively, as
output, permitting the design to be validated with the extremely high performance of the RNG allows
higher assurance than many other RNG designs. applications to gather extra data with minimal
Because the RNG may be used in multi-application overhead.
environments, we included tests that assumed that the
RNG was being shared by hostile processes running Bitrate. The RNG generates output at significantly
concurrently on the same processor. higher rates than most PC-based randomness resources.
Raw bits are produced at rates of 30 to 50 Mbits/sec,
Entropy. The raw bit generator (whitener disabled) was and whitened bits were observed at rates of 4 to 9
estimated to yield 0.78 to 0.99 bits of entropy per raw Mbits/sec. Variations in output rates depend on the
output bit. Operation with the whitener enabled is RNG configuration and the oscillator rates. PRNGs
believed to provide 0.99 bits (typical) of entropy per seeded with the Nehemiah RNG should be able to
easily sustain output in excess of 2 Mbits of entropy per
second, which should eliminate blocked PRNG reads in
1 A von Neumann whitener reduces single-bit biases by virtually all applications.
outputting either a single “whitened” bit or no bits for
every 2 bits generated by the raw source. This
whitening process can be disabled for testing purposes.
2 A complete description of operational modes is
available in the VIA C5XL Processor Random Number 3 Sensitive operations/applications (such as initial
Generator Application Note, provided by VIA PRNG seeding) should use even more conservative
Technologies. values if there is no significant performance impact.
MARCH 25, 2003 CRYPTOGRAPHY RESEARCH, INC. PAGE 2 OF 3
EVALUATION SUMMARY: VIA C3 NEHEMIAH RNG
31:22 21:16 15 14 13 12:10 9:8 7 6 5 4:0
Reserved String String String Raw bits DC bias Reserved Reserved RNG Reserved Current
Filter Filter Filter enable enable Byte
Count Failed Enable Cout
Read/ Read/ Read/ Read/ Read/ Read/ Read
Write Write Write Write Write Write only
Figure 3: Nehemiah RNG Configuration Register (MSR 0x110B)
RNG Use provides an additional margin of safety to applications
requiring randomness.
The RNG should be initialized at boot by code with
privileged (ring 0) access to a Nehemiah specific
Examples of commonly-used PRNGs include the
Machine Specific Register (MSR). The RNG may be Linux/UNIX /dev/random resource and the Yarrow5
used by any user-level application after it has been
PRNG. For OS randomness resources, the rate of
initialized.4
contributed entropy can be estimated as 0.75 bits of
entropy per XSTORE bit when the RNG is properly
As with any hardware entropy source, it is
configured, although conservative developers can
recommended that the Nehemiah RNG be used as a
always use smaller estimates for this value.
source of seed data for a cryptographically strong
PRNG or hash function. In such a design, an entropy
pool is