lowRISC / lowRISC/opentitan

[entropy_src] measurement of entropy is needed to configure health checks

Open
#22,320 2 comments 0 reactions 1 assignee View on GitHub

@moidx is already working on this.

Since Mar 28, 2024.

prodc-integration
Dominant language
SystemVerilog
Stars
3.6k
Forks
1.1k
Avg merge
2d 22h
Merged PRs (30d)
141

Description

Description

NIST 800-90B provides guidance how APT & RCT health checks shall be configured depending on required probability of detecting error and measured entropy.
For the approved continuous health tests, the false positive probability $\alpha$ is recommended to be between $2^{−20}$ and $2^{−40}$. Lower probability values are acceptable. The submitter shall specify and document a false positive probability suitable for their application

AIS.31 defines parameters for other tests.

NIST Entropy Assessment toolkit includes set of test, documented in NIST 800-90B to measure entropy for use in configuring health checks appropritately.

In my experience measurements would be in the range ~0.8-0.85 per bit even for very high quality entropy source, or, say DRBG output due to compression test nuances on 1-bit streams (alphabet of entropy source).

So, action items are:

  1. Measure entropy on different samples, take the minimum value (real tests involves environmental tests at different points in operational range)
  2. Calculate configuration of health checks
  3. Make sure that health checks are configured properly before using entropy.

@vogelpi @jadephilipoom

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.