i.MX Processors中的主题 Re: NIST statistical test failure on RNG

NIST statistical test failure on RNG

dhanushkadangam — Wed, 31 May 2017 10:04:46 GMT

We are using the imx6ul processor in an application where we need to obtain certification for random number generation sources. For this, we capture ~128MB of random data from /dev/random, /dev/urandom and /dev/hwrng interfaces and feed it to NIST statistical tests.

According to the Final Analysis Reports, "Overlapping (Periodic) Template Matching Test" scores below the minimum pass rate in all the above interfaces.

Why does this particular test fail on all interfaces?
What are the implications of this result on the certification?
Will some post-processing such as whitening help fix this?
Is there any specific configuration for the CAAM RNG that we should use? We are using yocto linux-3.14.38 without any modifications.

PS:

imx6ul SRM says the RNG should be instantiated in test mode to obtain data for certification. Even in test mode the above test fails. Below are extracts from the test reports for /dev/hwrng:

In normal mode:

------------------------------------------------------------------------------
C1 C2 C3 C4 C5 C6 C7 C8 C9 C10 P-VALUE PROPORTION STATISTICAL TEST
------------------------------------------------------------------------------
6 2 1 0 0 1 0 0 0 0 0.000199 6/10 * OverlappingTemplate

In test mode:

------------------------------------------------------------------------------
C1 C2 C3 C4 C5 C6 C7 C8 C9 C10 P-VALUE PROPORTION STATISTICAL TEST
------------------------------------------------------------------------------
7 1 1 1 0 0 0 0 0 0 0.000003 * 5/10 * OverlappingTemplate

The minimum pass rate for this test is 8 for a sample size of 10 binary sequences.

Re: NIST statistical test failure on RNG

igorpadykov — Wed, 31 May 2017 23:17:40 GMT

Hi dhanushka

RNG inside CAAM module i.MX6 is identical to the HW used
in NPD QorIQ devices based on NIST SP800-90. NPD has obtained a certificate for
RNG and because the HW is the same this certificate also covers i.MX6 as well. See

http://csrc.nist.gov/groups/STM/cavp/documents/drbg/drbgval.html Validation No 94.

Help with sertification tests can be obtained from Professional Services :

http://www.nxp.com/support/nxp-professional-services:PROFESSIONAL-SERVICE

Best regards
igor
-----------------------------------------------------------------------------------------------------------------------
Note: If this post answers your question, please click the Correct Answer button. Thank you!
-----------------------------------------------------------------------------------------------------------------------

Re: NIST statistical test failure on RNG

dhanushkadangam — Mon, 26 Jun 2017 09:20:00 GMT

It turned out that we had used wrong parameters for the test;

./assess 134217728

How many bitstreams? 10

when they should have been

./assess 1000000

How many bitstreams? 1073

With these new parameters, the Overlapping (Periodic) Template Matching Test passes for all interfaces.