[crypto/entropy] Make the entropy source ready for use by siemen11 · Pull Request #29615 · lowRISC/opentitan

siemen11 · 2026-03-29T11:32:52Z

This PR does the following:

Open the entropy init and check to the user. The user HAS to use this function since the ROM_EXT does NOT enable FIPS mode at plan of record. While it was originally planned for the ROM_EXT to drive this config, the entropy driver was not using correct thresholds while the ROM_EXT is now frozen. Hence, we need to move this to the firmware.
Add in basic fault injection protection by rereading the registers.
Prevent infinite timeouts by adding a timeout to all polling to improve reliability.
Set FIPS thresholds for the entropy source, leave the EDN config unchanged
Adapt all tests to use the new user exposed entropy functions with FIPS thresholds

siemen11 · 2026-03-29T12:05:29Z

A question: the entropy_complex_init now changed to new FIPS thresholds. Does this have an impact in provisioning or silicon_creator?

vsukhoml · 2026-03-30T20:28:29Z

sw/device/lib/crypto/drivers/entropy.c

+                        .adaptp_lo_threshold = 2048 - 1591,  // 457
+                        .bucket_threshold = 201,
+                        .markov_hi_threshold = 824,
+                        .markov_lo_threshold = 1024 - 824,  // 200


This configuration is made under assumption that OpenTitan implements analogue part of entropy source with H=0.5. It may not be true for other implementations.

You mean to leave this setting specifically for earlgrey_1.0.0? I will add a comment on this

Originally, the idea was to call entropy_complex_init in the ROM_EXT to instantiate the RNG in a final FIPS state. However, the ROM_EXT is in its frozen final version and the entropy_complex_init still has dummy threshold values. Hence, the entropy_complex_init should be called from firmware instead. However, the entropy_complex_init is only a driver function returning a regular status_t, it is not an impl function with an otcrypto_status_t. Hence, it is not opened up to the user. Instead, make a wrapper to the functions needed by the user and add them in the include folder. Switch all functests to use the wrapper instead (since ideally to ingest impl functions). Collateral: looks like the driver was some glue for missing Bazel dependencies, add rv_core_ibex to the random_order function. Signed-off-by: Siemen Dhooghe <sdhooghe@google.com>

The TODOs in entropy specified to ensure fault protection. With the entropy source configure, reread the registers to ensure the configuration written is the expected one. Remove the TODOs. The entropy check is presumed to be called multiple times, hence it does not need additional protection. Signed-off-by: Siemen Dhooghe <sdhooghe@google.com>

Add timeouts to all polling of registers. This is just to add reliability in situations where the chips experiences a malfunction. Signed-off-by: Siemen Dhooghe <sdhooghe@google.com>

Set the entropy source driver to align with certified NIST SP 800-90B requirements. Specific changes include: - NIST 800-90B Health Test Thresholds: Increased the `fips_test_window_size` to 2048 bits to comply with FIPS standards for binary noise sources. - Bypass Register Configuration: Updated the `SET_FIPS_THRESH` and `VERIFY_FIPS_THRESH` macros to write and verify both the `FIPS_THRESH` and `BYPASS_THRESH` fields simultaneously. Note: CSRNG `FIPS_FORCE_ENABLE` and EDN continuous polling rates remain at their defaults to ensure the FIFO does not run empty with, for exmaple, the OTBN during the initial TRNG FIPS warm-up phase. Signed-off-by: Siemen Dhooghe <sdhooghe@google.com>

johannheyszl · 2026-04-01T10:11:16Z

sw/device/lib/crypto/drivers/entropy.c

-            },
+            // All cut off values are calculated with the assumption that:
+            // H=0.5 per bit => H=2 for 4-bit symbols
+            // α = 2⁻⁴⁰ (alpha = 2^-40), false positive probability


Suggested change

// α = 2⁻⁴⁰ (alpha = 2^-40), false positive probability

// α = 2⁻⁴⁰ (alpha = 2^-40), false positive probability

// Please note that entropy H per bit will depend on silicon and will likely need to be adapted.

johannheyszl · 2026-04-01T10:11:31Z

sw/device/lib/crypto/drivers/entropy.c

-                    },
-            },
+            // All cut off values are calculated with the assumption that:
+            // H=0.5 per bit => H=2 for 4-bit symbols


Suggested change

// H=0.5 per bit => H=2 for 4-bit symbols

// H = 0.5 per bit => H = 2 for 4-bit symbols

johannheyszl

Thanks @siemen11 this lgtm - important we can call this from user

johannheyszl · 2026-04-01T10:13:06Z

sw/device/lib/crypto/include/entropy_src.h

+otcrypto_status_t otcrypto_entropy_init(void);
+
+/**
+ * Ensures that the entropy complex is ready for use and verify the health


Suggested change

* Ensures that the entropy complex is ready for use and verify the health

* Ensures that the entropy complex is ready for use and runs the health

johannheyszl · 2026-04-01T10:13:18Z

sw/device/lib/crypto/include/entropy_src.h

+
+/**
+ * Ensures that the entropy complex is ready for use and verify the health
+ * checks of the generated randomness.


Suggested change

* checks of the generated randomness.

* checks for the generated randomness.

johannheyszl · 2026-04-01T10:13:57Z

sw/device/lib/crypto/include/entropy_src.h

+ * Ensures that the entropy complex is running and that `entropy_src` is in
+ * FIPS mode, and verifies the thresholds for health tests in `entropy_src`.
+ * This function should be called periodically while the entropy complex is in
+ * use, because the threshold registers are not shadowed.


Suggested change

* use, because the threshold registers are not shadowed.

* use, to prevent FI because the threshold registers are not shadowed.

johannheyszl · 2026-04-01T10:14:17Z

sw/device/lib/crypto/include/entropy_src.h

+ * use, because the threshold registers are not shadowed.
+ *
+ * The test also verifies the health checks of the generated randomness
+ * providing a status error if a health test jumped.


Suggested change

* providing a status error if a health test jumped.

* providing a status error if a health test failed.

siemen11 requested a review from a team as a code owner March 29, 2026 11:32

siemen11 requested review from andrea-caforio, cfrantz, johannheyszl, moidx, nasahlpa, pamaury and vsukhoml and removed request for a team and pamaury March 29, 2026 11:32

siemen11 added the CherryPick:master This PR should be cherry-picked to master label Mar 29, 2026

siemen11 requested a review from timothytrippel March 29, 2026 12:05

siemen11 force-pushed the entropy_src_config branch 5 times, most recently from 0912e5f to d33fd99 Compare March 30, 2026 09:26

siemen11 added the CI:Rerun Rerun failed CI jobs label Mar 30, 2026

vsukhoml reviewed Mar 30, 2026

View reviewed changes

vsukhoml approved these changes Mar 30, 2026

View reviewed changes

siemen11 force-pushed the entropy_src_config branch from d33fd99 to 9cca2bb Compare March 31, 2026 07:58

cfrantz approved these changes Mar 31, 2026

View reviewed changes

siemen11 added 4 commits March 31, 2026 17:54

[crypto/entropy] Avoid infinite polls

0898d6f

Add timeouts to all polling of registers. This is just to add reliability in situations where the chips experiences a malfunction. Signed-off-by: Siemen Dhooghe <sdhooghe@google.com>

siemen11 force-pushed the entropy_src_config branch from 9cca2bb to fce0466 Compare March 31, 2026 15:59

siemen11 removed CherryPick:master This PR should be cherry-picked to master CI:Rerun Rerun failed CI jobs labels Mar 31, 2026

siemen11 added the CI:Rerun Rerun failed CI jobs label Apr 1, 2026

github-actions bot removed the CI:Rerun Rerun failed CI jobs label Apr 1, 2026

johannheyszl reviewed Apr 1, 2026

View reviewed changes

johannheyszl approved these changes Apr 1, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[crypto/entropy] Make the entropy source ready for use#29615

[crypto/entropy] Make the entropy source ready for use#29615
siemen11 wants to merge 4 commits intolowRISC:earlgrey_1.0.0from
siemen11:entropy_src_config

siemen11 commented Mar 29, 2026

Uh oh!

siemen11 commented Mar 29, 2026

Uh oh!

vsukhoml Mar 30, 2026

Uh oh!

siemen11 Mar 31, 2026

Uh oh!

johannheyszl Apr 1, 2026

Uh oh!

johannheyszl Apr 1, 2026

Uh oh!

johannheyszl left a comment

Uh oh!

johannheyszl Apr 1, 2026

Uh oh!

johannheyszl Apr 1, 2026

Uh oh!

johannheyszl Apr 1, 2026

Uh oh!

johannheyszl Apr 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

	// α = 2⁻⁴⁰ (alpha = 2^-40), false positive probability
	// α = 2⁻⁴⁰ (alpha = 2^-40), false positive probability
	// Please note that entropy H per bit will depend on silicon and will likely need to be adapted.

	// H=0.5 per bit => H=2 for 4-bit symbols
	// H = 0.5 per bit => H = 2 for 4-bit symbols

	* Ensures that the entropy complex is ready for use and verify the health
	* Ensures that the entropy complex is ready for use and runs the health

	* checks of the generated randomness.
	* checks for the generated randomness.

	* use, because the threshold registers are not shadowed.
	* use, to prevent FI because the threshold registers are not shadowed.

	* providing a status error if a health test jumped.
	* providing a status error if a health test failed.

Conversation

siemen11 commented Mar 29, 2026

Uh oh!

siemen11 commented Mar 29, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

johannheyszl left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants