Files
freebsd/sys/modules
David E. O'Brien 1b7bd82b6d random: add RDSEED as a provably unique entropy source
NIST SP800-90B allows for only a single entropy source to be claimed
in a FIPS-140-3 certificate.  In addition, only hardware sources that
have a NIST Entropy Source Validation (ESV) certificate, backed by
a SP800-90B Entropy Assessment Report, are usable.  Intel has obtained
ESV certificates for several of their processors, so RDSEED is a
FIPS-140-3 suitable entropy source.

However, even though RDRAND is seeded by RDSEED internally, RDRAND
would need a RBG certificate and CAVP testing run on the DRBG in order
to use it for FIPS-140-3 (SP800-90B) purposes.  So we need to know
down in the CSPRNG-subsystem which source the entropy came from.

In light of the potential issues surrounding AMD Zen 5 CPU's RDSEED
implementation[*], allow RDSEED to be disabled in loader.conf.
[*] https://www.phoronix.com/news/AMD-EPYC-Turin-RDSEED-Bug

Approved by:	re (cperciva)
Reviewed by:	cem
MFC after:	3 days
Sponsored by:	Juniper Networks
Differential Revision:	https://reviews.freebsd.org/D53150
Differential Revision:	https://reviews.freebsd.org/D53291
(cherry picked from commit 3a12982962)
(cherry picked from commit 38e9d282cd)
(cherry picked from commit 9ca8e09abb)
2025-11-03 12:28:29 -08:00
..
…
…
…
…
2025-10-23 16:32:44 -07:00
…
…
2025-01-23 11:20:42 -05:00
2025-04-08 05:57:10 +00:00
2025-07-18 13:16:16 -06:00
2024-10-28 15:55:25 -07:00
…
…
…
2025-05-04 22:55:08 +00:00
…
2025-06-16 13:56:52 -04:00
…
…
…
2024-12-17 11:07:12 +01:00
…
…
…
…
…
2025-09-18 13:53:13 +01:00
…