[Cryptech Tech] FIPS 140-2 test program

[Joachim Strömbergson]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Aloha!

Stephan Mueller wrote:
> This is no current FIPS 140-2 test suite for non-deterministic RNGs.
> The program is from 2001. If you are looking for a current entropy 
> assessment discussion, have a look at SP800-90B and C.
> 
> But in any case, the ent tool gives you a "smoke" test indicator
> whether the statistics look good -- in particular the Chi-Square
> test. The dieharder test suite is a more comprehensive testset.

The reason for posting about the tool is that it is the only open
implementation of FIPS 140-2 tests I have found to date. There are
several other tools to use, but there is also a general lack of good,
well maintained, open and easy to use tools (imho). I plan to build a
list of test suites and tools on the wiki. But if anybody have a list or
can build one instead it would be great.

There are for example several instances in more or less dead state of
the Marsaglia diehard test. Then we have Dieharder that is a superset of
diehard and a few other sets.

Ent as you say is fast and gives a smoke test.

Haveged (the entropy source) contains a test that when we tested was
unable to detect a broken implementation.

As you say, we have test specified in SP800-90, there are also
requirements in SP 800-21. Then there is FIPS 140-2, which is probably
the most often sited suites for HSMs and TRNGs. But finding real code
usable to test for FIPS 140-2 has at least for me been less then
satisfactory. Finally there is also tests and requirements in FIPS 186.

Stepping away from NIST, SBI in germany has the AIS-31 tests for
physical based TRNGs as well as AIS-20 (if I remember correctly) for
testing CSPRNGs. Finally there are some ISO/IEC counterparts to FIPS
140-2, again if I remember correctly.

A clarified list like this above and tools to allow Cryptech
implementers and users to test their implementations is one of the most
important things that we could produce (imho). Any contributions in
terms if text, links etc would be greatly appreciated.

- -- 
Med vänlig hälsning, Yours

Joachim Strömbergson - Alltid i harmonisk svängning.
========================================================================
 Joachim Strömbergson          Secworks AB          joachim at secworks.se
========================================================================
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.22 (Darwin)
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQIcBAEBCAAGBQJTxMtmAAoJEF3cfFQkIuyNsVkP/ifZ72eGRArkvYAFR0v5LepZ
T5yifarrrIerzBl0qfhUyGkbBN1E9GoHOi9xo2MMXfcAkw/mE6pGqmutDkjhq0r9
+fHK5epshgFVry0mVVDkBKCRV8SmG67eToniTS2O1CcAxbOQ1+LUqgEMlm6zICuV
3sbfD7qxSIRcTuHvAjieRAuwKduFCQv3b3P47Q/AvhB7BLJo4wKng+jOifu+9U0a
k7tiTqVqIRjIkxFVIuWEHk17z4PmOtHN+zx6YpM6jvwTcwfKm6KCZgQO2+ZV0QWm
8k/VWpmaqHsLaORmyFKgDM08qiHQgJHpoiTI//MIx+3QUUSX+M7ncyumlvx/fEc/
Z1KVQKkUdOf0oWweTKGKDMqJx+oV3e+PurOI1F7GBQIk7HpaMsvvZfdxHoQsQCVB
BhhEAMGN9sShPNgvZibPhewsTHPO5W6ceeRCS4c3V2jfRfkCVxYnHgIE+WtNWzek
8HOvuQNOByRT1S9iQpegwwrLCRULa58kIleuYOevLYYqt6QEvQB9NISkp8Y01R4j
yB1jaT9cHb3lx1gEV0FPsSJsMX1OW+qcdOIHWDuEJcPPJCgibSklPusgFVFjR66H
FKIjsCt7kE88TCycUjBIqO2cSNDeAq1fGIVeiCF8GuMPM8xDN5gol+Vj6MPZHKd5
7tg38ORddy6HR/sbkJ0z
=htKr
-----END PGP SIGNATURE-----