Penetration Test Report (Cryptography Research): VIA rng

E
VALUATION OF
VIA C3 N
EHEMIAH
R N G
ANDOM UMBER ENERATOR
PREPARED BY
Cryptography Research, Inc.
607 Market St., 5th Floor
San Francisco, CA 94105[PII_REDACTED]
Last Revision: February 27, 2003
Information in this white paper is provided without guarantee or warranty of any
kind. This review was performed for VIA Technologies, Inc. but represents the
findings and opinions of Cryptography Research, Inc. and may or may not reflect
opinions of VIA Technologies, Inc. or Centaur Technology. Characteristics of the
C3 Nehemiah may vary with design or implementation changes.
© 2003 by Cryptography Research, Inc.
VIA C3 NEHEMIAH RNG EVALUATION
Contents
1. Introduction _________________________________________________ 4
2. Background__________________________________________________ 4
2.1. Applications Requiring Randomness ______________________________________4
2.2. Sources of Randomness__________________________________________________5
3. Design Overview______________________________________________ 7
3.1. Entropy Source ________________________________________________________7
3.2. Digital Hardware and Firmware_________________________________________10
4. Entropy Analysis ____________________________________________ 11
4.1. Background on Entropy________________________________________________11
4.2. Tools and Approaches__________________________________________________12
4.3. Aspects Studied _______________________________________________________13
4.4. Results ______________________________________________________________14
4.4.1. Normal Operation ________________________________________________________14
4.4.2. Startup Behavior _________________________________________________________21
4.4.3. Temperature_____________________________________________________________22
4.4.4. Processor Activity________________________________________________________23
4.4.5. Modeled Operation _______________________________________________________23
4.4.6. Results from Centaur Technologies Testing ____________________________________24
4.5. Source Whitening: Extrapolating Test Results _____________________________25
4.6. Entropy Conclusions___________________________________________________28
5. Usage Recommendations______________________________________ 29
5.1. Usage Modes _________________________________________________________29
5.2. Feeding an Entropy Pool with the Nehemiah RNG__________________________30
FEBRUARY 27, 2003 CRYPTOGRAPHY RESEARCH, INC. PAGE 2 OF 41
VIA C3 NEHEMIAH RNG EVALUATION
5.3. RNG Command overview_______________________________________________32
5.3.1. The Configuration MSR ___________________________________________________32
5.3.2. The XSTORE Operation___________________________________________________33
5.3.3. Determining RNG Availability______________________________________________34
5.4. Recommended Usage Procedures ________________________________________34
5.4.1. Boot-Time Initialization ___________________________________________________34
5.4.2. Application Start Sequence_________________________________________________35
5.4.3. Extracting Random Data___________________________________________________36
5.4.4. Maintaining an Entropy Pool________________________________________________37
5.5. Random Numbers for Non-Secure Applications ____________________________38
6. Closing Commentary_________________________________________ 39
FEBRUARY 27, 2003 CRYPTOGRAPHY RESEARCH, INC. PAGE 3 OF 41
VIA C3 NEHEMIAH RNG EVALUATION
1. Introduction
Randomness is required for a variety of computational, statistical, and security-related
applications. In particular, random numbers and the processes used to generate them are
a critical component of secure protocols and cryptographic key generation. Security
processes that lack adequate sources of randomness will have poor security.
Cryptography Research has evaluated the C3 Nehemiah random number generator, which
is an on-chip component of the VIA Technologies Nehemiah processor core. When
properly used, the generator was found to be a consistent, high-rate source of entropy
which we believe is suitable for use in cryptographic and high-assurance applications.
This report analyzes the Nehemiah RNG design, provides an entropy analysis of the
source, and provides developer recommendations for proper use of the Nehemiah RNG.
Cryptography Research provided no Nehemiah design assistance to VIA Technologies or
Centaur Technology.
2. Background
2.1. Applications Requiring Randomness
In general, random numbers can be summarized as numbers that are indistinguishable
from outcomes that would arise purely by chance. The quality of a random number
generator is often measured by the degree to which it produces unpredictable and
unbiased output.
Many cryptographic protocols require secret numbers. For example:
• Conventional encryption requires the generation of unguessable keys.
• The computation of a digital signature with the Digital Signature Algorithm
requires, besides the signer's private key, a value customarily called k that must be
secret, and that must not be re-used.
FEBRUARY 27, 2003 CRYPTOGRAPHY RESEARCH, INC. PAGE 4 OF 41
VIA C3 NEHEMIAH RNG EVALUATION
• Standards for message encryption using the RSA algorithm generally require the
use of random numbers to form message padding.
• Many challenge-response protocols require the use of a unique number, or nonce.
In practice, a good way to produce a number with a large likelihood of being
unique is to use a sufficiently large random number.
Random numbers are also widely used in numerical simulations, gaming, statistical
analysis, and distributed computations. While a high quality random source is always
best, randomness requirements vary among applications. For example, numerical
simulations often require random numbers that are unbiased, but have fewer
unpredictability requirements. In contract, cryptographic applications often have
extremely strong unpredictability requirements but may be slightly tolerant of biased
information. While this report focuses on the use of the Nehemiah RNG for
cryptographic applications, the results may be applied to other applications.
2.2. Sources of Randomness
Randomness can be found in several places, the more noteworthy of which we will now
discuss.
Quantum Phenomena. Devices have been specifically designed to translate quantum-
mechanical uncertainty into random digits, typically harnessing radioactive decay (the
classic case being Rand Corporation's book, "A Million Random Digits", published in the
1950's).
Thermal Noise. Excluding quantum mechanics, the behavior of physical systems is
deterministic (e.g. given a complete description of a system, one can compute its future
behavior). While this appears to make random number generation impossible, the fact
that matter is composed of particles endowed with disorganized thermal motion makes it
impossible, for practical purposes, to achieve a complete description of a system.
Accordingly, the places where thermal motion affects a circuit's behavior offer sources of
effective randomness.
FEBRUARY 27, 2003 CRYPTOGRAPHY RESEARCH, INC. PAGE 5 OF 41
VIA C3 NEHEMIAH RNG EVALUATION
For example, where electrons must surmount a potential barrier to move from one
conductor to another, each electron's thermal motion may help it or hinder it in crossing
the barrier, so that the total charge transferred during some time window varies.
Similarly, thermal movements of silicon atoms in a small region of the crystal lattice
momentarily affect current flow through that region, again affecting the charge
transferred during any given time window.
External Influences. Cosmic rays, temperature fluctuations, supply-voltage variations,
and stray electromagnetic fields may change a circuit's behavior and are generally
considered to be unpredictable enough to be counted as contributing to cryptographically
useful randomness.
Timings of network message arrivals, keystrokes, mouse movements, and d