blog/data/2017-03-01-chaoskey.txt

   1 Title: Unlimited randomness with the ChaosKey?
   2 Tags: english, debian
   3 Date: 2017-03-01 20:50
   4
   5 <p>A few days ago I ordered a small batch of
   6 <a href="http://altusmetrum.org/ChaosKey/">the ChaosKey</a>, a small
   7 USB dongle for generating entropy created by Bdale Garbee and Keith
   8 Packard.  Yesterday it arrived, and I am very happy to report that it
   9 work great!  According to its designers, to get it to work out of the
  10 box, you need the Linux kernel version 4.1 or later.  I tested on a
  11 Debian Stretch machine (kernel version 4.9), and there it worked just
  12 fine, increasing the available entropy very quickly.  I wrote a small
  13 test oneliner to test.  It first print the current entropy level,
  14 drain /dev/random, and then print the entropy level for five seconds.
  15 Here is the situation without the ChaosKey inserted:</p>
  16
  17 <blockquote><pre>
  18 % cat /proc/sys/kernel/random/entropy_avail; \
  19   dd bs=1M if=/dev/random of=/dev/null count=1; \
  20   for n in $(seq 1 5); do \
  21      cat /proc/sys/kernel/random/entropy_avail; \
  22      sleep 1; \
  23   done
  24 300
  25 0+1 oppføringer inn
  26 0+1 oppføringer ut
  27 28 byte kopiert, 0,000264565 s, 106 kB/s
  28 4
  29 8
  30 12
  31 17
  32 21
  33 %
  34 </pre></blockquote>
  35
  36 <p>The entropy level increases by 3-4 every second.  In such case any
  37 application requiring random bits (like a HTTPS enabled web server)
  38 will halt and wait for more entrpy.  And here is the situation with
  39 the ChaosKey inserted:</p>
  40
  41 <blockquote><pre>
  42 % cat /proc/sys/kernel/random/entropy_avail; \
  43   dd bs=1M if=/dev/random of=/dev/null count=1; \
  44   for n in $(seq 1 5); do \
  45      cat /proc/sys/kernel/random/entropy_avail; \
  46      sleep 1; \
  47   done
  48 1079
  49 0+1 oppføringer inn
  50 0+1 oppføringer ut
  51 104 byte kopiert, 0,000487647 s, 213 kB/s
  52 433
  53 1028
  54 1031
  55 1035
  56 1038
  57 %
  58 </pre></blockquote>
  59
  60 <p>Quite the difference. :) I bought a few more than I need, in case
  61 someone want to buy one here in Norway. :)</p>
  62
  63 <p>Update: The dongle was presented at Debconf last year.  You might
  64 find <a href="https://debconf16.debconf.org/talks/94/">the talk
  65 recording illuminating</a>.  It explains exactly what the source of
  66 randomness is, if you are unable to spot it from the schema drawing
  67 available from the ChaosKey web site linked at the start of this blog
  68 post.</p>