Skip to content

Commit

Permalink
Add option to retrieve additionaly entropy from YubiKey itself
Browse files Browse the repository at this point in the history
  • Loading branch information
mirko committed Aug 29, 2020
1 parent 697a7d8 commit 767b84e
Showing 1 changed file with 13 additions and 0 deletions.
13 changes: 13 additions & 0 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -320,6 +320,18 @@ $ cat /proc/sys/kernel/random/entropy_avail

Most operating systems use software-based pseudorandom number generators. A hardware random number generator like [OneRNG](https://onerng.info/onerng/) will [increase the speed](https://lwn.net/Articles/648550/) of entropy generation and possibly the quality.

From YubiKey firmware version 5.2.3 onwards - which introduces "Enhancements to OpenPGP 3.4 Support" - we can gather additional entropy from the YubiKey itself via the SmartCard interface.

## YubiKey

To feed the system's PRNG with entropy generated by the YubiKey itself, issue:
```console
$ echo "SCD RANDOM 512" | gpg-connect-agent | sudo tee /dev/random | hexdump -C
```
This will seed the Linux kernel's PRNG with additional 512 bytes retrieved from the YubiKey.

## OneRNG

Install and configure OneRNG software:

```console
Expand Down Expand Up @@ -2447,3 +2459,4 @@ Admin PIN: 12345678
* https://www.void.gr/kargig/blog/2013/12/02/creating-a-new-gpg-key-with-subkeys/
* https://mlohr.com/gpg-agent-forwarding/
* https://www.ingby.com/?p=293
* https://support.yubico.com/support/solutions/articles/15000027139-yubikey-5-2-3-enhancements-to-openpgp-3-4-support

0 comments on commit 767b84e

Please sign in to comment.