Re: libnss x86 DRNG

2012-10-04 Thread Michael Demeter
This is a reasonable use.. This can simply be implemented in the primitive where /dev/random is used. It would only need a HW check during initialization to enable using the DRNG or leave it as is in the event HW does not support it.. Michael Demeter Staff Software Engineer Open Source Technolog

Re: libnss x86 DRNG

2012-10-03 Thread Wan-Teh Chang
On Tue, Oct 2, 2012 at 9:02 PM, Robert Relyea wrote: > > But we can use it go seed the prng. There's a pretty easy way to get NSS to > use HW generated values to get some initial entropy: If you create a PKCS > #11 module that advertises a RNG (See the PKCS #11 spec), NSS will mix > entropy from i

Re: libnss x86 DRNG

2012-10-02 Thread Robert Relyea
On 10/02/2012 05:42 PM, Wan-Teh Chang wrote: On Tue, Oct 2, 2012 at 7:45 PM, Michael Demeter wrote: Continuation would then be to eliminate any unnecessary work being done to increase the randomness..Since the HW generated values can be used directly. This could help a small little bit in perf

Re: libnss x86 DRNG

2012-10-02 Thread Wan-Teh Chang
On Tue, Oct 2, 2012 at 7:45 PM, Michael Demeter wrote: > > Continuation would then be to eliminate any unnecessary work being > done to increase the randomness..Since the HW generated values > can be used directly. This could help a small little bit in performance > (but that is a secondary effect

Re: libnss x86 DRNG

2012-10-02 Thread Michael Demeter
Thanks for the response.. See inline comments On Oct 1, 2012, at 5:22 PM, Ryan Sleevi wrote: > Hi Michael, > > There is definite interest in being able to take advantage of hardware > intrinsics - whether they be the DRNG or the AESNI instructions. For > example, NSS just recently added supp

Re: libnss x86 DRNG

2012-10-01 Thread Ryan Sleevi
On Mon, October 1, 2012 3:08 pm, Michael Demeter wrote: > Hello, > > I work in the Open Source Technology group at Intel in the security group. > > I have been tasked with contacting the maintainer of libnss to start > discussions about the possibility of Intel submitting patches to enable > t

libnss x86 DRNG

2012-10-01 Thread Michael Demeter
Hello, I work in the Open Source Technology group at Intel in the security group. I have been tasked with contacting the maintainer of libnss to start discussions about the possibility of Intel submitting patches to enable the new HW based digital random number generator. What I would like to