CONFIG_RANDOM_TRUST_CPU: Initialize RNG using CPU RNG instructions

General informations

The Linux kernel configuration item CONFIG_RANDOM_TRUST_CPU has multiple definitions:

Initialize RNG using CPU RNG instructions found in drivers/char/Kconfig

The configuration item CONFIG_RANDOM_TRUST_CPU:

• prompt: Initialize RNG using CPU RNG instructions
• type: bool
• depends on: (none)
• defined in drivers/char/Kconfig
• found in Linux kernels: 5.19, 6.0, 6.0+HEAD

Help text

Initialize the RNG using random numbers supplied by the CPU's RNG instructions (e.g. RDRAND), if supported and available. These random numbers are never used directly, but are rather hashed into the main input pool, and this happens regardless of whether or not this option is enabled. Instead, this option controls whether the they are credited and hence can initialize the RNG. Additionally, other sources of randomness are always used, regardless of this setting. Enabling this implies trusting that the CPU can supply high quality and non-backdoored random numbers.

Say Y here unless you have reason to mistrust your CPU or believe its RNG facilities may be faulty. This may also be configured at boot time with "random.trust_cpu=on/off".

Trust the CPU manufacturer to initialize Linux's CRNG found in drivers/char/Kconfig

The configuration item CONFIG_RANDOM_TRUST_CPU:

• prompt: Trust the CPU manufacturer to initialize Linux's CRNG
• type: bool
• depends on: CONFIG_ARCH_RANDOM
• defined in drivers/char/Kconfig
• found in Linux kernels: 4.19–4.20, 5.0–5.18, 5.19-rc+HEAD

Help text

Assume that CPU manufacturer (e.g., Intel or AMD for RDSEED or RDRAND, IBM for the S390 and Power PC architectures) is trustworthy for the purposes of initializing Linux's CRNG. Since this is not something that can be independently audited, this amounts to trusting that CPU manufacturer (perhaps with the insistence or mandate of a Nation State's intelligence or law enforcement agencies) has not installed a hidden back door to compromise the CPU's random number generation facilities. This can also be configured at boot with "random.trust_cpu=on/off".

Hardware

LKDDb

Raw data from LKDDb:

• (none)

Sources

This page is automaticly generated with free (libre, open) software lkddb(see lkddb-sources).

The data is retrived from:

• Linux kernel
• Linux Kernel Driver DataBase (LKDDb)

Automatic links from Google (and ads)

Custom Search

Popular queries: