[Cryptech Tech] Fast(er) warm up of the TRNG.

[Joachim Strömbergson]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Aloha!

Here is an idea:

How about if we provide unused seed values from previous operations as
initial entropy? The idea is similar to what several OS:es do to shorten
the time to operational /dev/random. In our case we would (for example)
save a few seed (2-3 x 512 bits) in an FPGA-external battery powered
SRAM, the same as we use for storing master key(s).

When the Cryptech HW-system is powering up, it check if there are any
seed values stored. If there are, these seeds are read back from the
SRAM into the TRNG and fed into the mixer part of the collector and used
to create an initial seed. This would allow the TRNG to be able to start
very fast (usec- msec) for all but the very first power up.

If we trust the SRAM to hold master keys, we should be able to trust it
to store seed values/initial entropy.

And yes, they could also be used directly. I just liked the idea of
treating the old seeds as coming from an entropy source, thereby
removing any need for having a way to bypass the mixer and inject seed
values for normal TRNG operation. The CSPRNG becomes simpler and we
reduce the risk of manipulation. IMHO.

- -- 
Med vänlig hälsning, Yours

Joachim Strömbergson - Alltid i harmonisk svängning.
========================================================================
 Joachim Strömbergson          Secworks AB          joachim at secworks.se
========================================================================
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.22 (Darwin)
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQIcBAEBCAAGBQJTIdzuAAoJEF3cfFQkIuyNqKMP/R2SsTRPSg9nyFrjdKM38Jua
W4TtEdQelyuvLpxppgKiBevgxnhH901IAv0VM5JDDYpin6GUP4chCqngQWVt1a9T
TLxoJ2ZbijO0Uhh5Sr8rZvbaPK2LVzyL4PU/7A0cOY8iiwaZMU7+sg2P9/r5A65d
iqjKoPMd3q2E/LTls7bjJAUiqJN9OLTV0cAzerJ2LasWPhg+dHGwEXk4PUZjwoyT
sZifhrEDiCW7uib+NxBqi6M1M5tvB8xTpRfxfcw30xHZoTEHDGSgfz5a7QyrmtSj
2AbnZakWoUd/C/x0YAiLch+J6p+Wl5OmEbhV4lHY5ZmJ9PScXgOx/RasXoyZMoJ+
OCb54q9GmtMNZXydQho4VG5Jps8LwgHwoxiMriGxPykdWbdZPN+Bl8W3SbjtBpVf
pG17lxwWTB03PVy1QJwdaa70Q7L71bnXehl5h5BMPWx5DGD9p8chq5GZNDjjzDdo
sY9XCOAGVaKFvg4I47O7oUrBih9nSa9uOpx6swh75rbxNzmiNDcKkwuori+ChG8W
vp9EVRFv1U/m9fPkxx2vGKU7tKwZMgvgey8KFvqkzYujKeu5LoZr5w9kb+Jl3H3B
yygDNGRYyvpWyMQe/a0vJ4EiLXTVJznrQB72mISfF7CctmaASd+HFad6Zp5e3tS6
R5fxVvreugOEkBiLcgIv
=ivl9
-----END PGP SIGNATURE-----