1# Random configuration options 2 3# Copyright (c) 2017 Intel Corporation 4# SPDX-License-Identifier: Apache-2.0 5 6menu "Random Number Generators" 7 8config TEST_RANDOM_GENERATOR 9 bool "Allow non-random number generator" 10 help 11 This option signifies that a non-random number generator is allowed to 12 be used and the kernel's random number APIs are permitted to return 13 values that are not truly random. 14 15 This capability is provided for testing purposes when a truly random 16 number generator is not available. The non-random number generator 17 should not be used in a production environment. 18 19 This option is intended to be selected only by application-level 20 configurations (e.g. in tests and samples) to indicate that the 21 application is allowed to run with a random number generator that is not 22 truly random. Board-level configurations must not select this option 23 unless the sole purpose of the board is testing (e.g. QEMU emulation 24 boards). 25 26 Note that this option does not imply that a non-random number generator 27 is selected -- that is indicated by RNG_GENERATOR_CHOICE. An entropy 28 device-backed random number generator, if available, will be selected by 29 default even when CONFIG_TEST_RANDOM_GENERATOR=y. 30 31config TIMER_RANDOM_INITIAL_STATE 32 int "Initial state used by clock based number generator" 33 default 123456789 34 help 35 Initial state value used by TIMER_RANDOM_GENERATOR and 36 early random number genenator. 37 38 39choice RNG_GENERATOR_CHOICE 40 prompt "Random generator" 41 default ENTROPY_DEVICE_RANDOM_GENERATOR if ENTROPY_HAS_DRIVER 42 default TIMER_RANDOM_GENERATOR if TEST_RANDOM_GENERATOR 43 depends on ENTROPY_HAS_DRIVER || TEST_RANDOM_GENERATOR 44 help 45 Platform dependent non-cryptographically secure random number support. 46 47 If the entropy support of the platform has sufficient performance 48 to support random request then select that. Otherwise, select the 49 XOSHIRO algorithm 50 51config TIMER_RANDOM_GENERATOR 52 bool "System timer clock based number generator" 53 depends on TEST_RANDOM_GENERATOR 54 help 55 This options enables number generator based on system timer 56 clock. This number generator is not random and used for 57 testing only. 58 59config ENTROPY_DEVICE_RANDOM_GENERATOR 60 bool "Use entropy driver to generate random numbers" 61 depends on ENTROPY_HAS_DRIVER 62 help 63 Enables a random number generator that uses the enabled hardware 64 entropy gathering driver to generate random numbers. Should only be 65 selected if hardware entropy driver is designed to be a random 66 number generator source. 67 68config XOSHIRO_RANDOM_GENERATOR 69 bool "Use Xoshiro128++ as PRNG" 70 depends on ENTROPY_HAS_DRIVER 71 help 72 Enables the Xoshiro128++ pseudo-random number generator, that uses 73 the entropy driver as a seed source. This is a fast general-purpose 74 non-cryptographically secure random number generator. 75 76endchoice # RNG_GENERATOR_CHOICE 77 78 79DT_CHOSEN_Z_ENTROPY := zephyr,entropy 80config ENTROPY_NODE_ENABLED 81 bool 82 default y if $(dt_chosen_enabled,$(DT_CHOSEN_Z_ENTROPY)) 83 help 84 Helper to state that in the DT the "zephyr,entropy" property points to 85 the node of an entropy generator unit. 86 Warning #1: unfortunately having this property set does not guarantee in 87 all cases that enabling CONFIG_ENTROPY_GENERATOR will make the corresponding 88 driver available. This because that driver might be gated by other 89 Kconfig that are not enabled in the build. 90 Warning #2: even in case blindly enabling CONFIG_ENTROPY_GENERATOR whenever 91 CONFIG_ENTROPY_NODE_ENABLED is set works fine, it might not be the desired 92 effect for all the scenarios because then the driver will effectively be 93 enabled even if there is no usage of it. 94 The only workaround for these problems to tentatively enable 95 CONFIG_CSPRNG_NEEDED and check the "return value" on CONFIG_CSPRNG_ENABLED. 96 97config CSPRNG_NEEDED 98 bool "Use CSPRNG if possible on the current platform" 99 select ENTROPY_GENERATOR if ENTROPY_NODE_ENABLED 100 help 101 If a DT node exists for an entropy generator (i.e. CONFIG_ENTROPY_NODE_ENABLED 102 is set) then enable this symbol and check the "result" in CONFIG_CSPRNG_ENABLED 103 to see if the corresponding driver was really enabled in the build. 104 This will ensure that (a) there really is a entropy driver for this platform and 105 (b) it will only get enabled when there is someone needing it. 106 107# 108# Implied dependency on a cryptographically secure entropy source when 109# enabling CS generators. ENTROPY_HAS_DRIVER is the flag indicating the 110# CS entropy source. 111# 112config CSPRNG_ENABLED 113 bool 114 default y 115 depends on ENTROPY_HAS_DRIVER 116 help 117 Helper to confirm that there is an hardware entropy unit enabled in the build 118 that can be used to provide CS random values. 119 120 121choice CSPRNG_GENERATOR_CHOICE 122 prompt "Cryptographically secure random generator" 123 default HARDWARE_DEVICE_CS_GENERATOR 124 default TEST_CSPRNG_GENERATOR 125 help 126 Platform dependent cryptographically secure random number support. 127 128 If the hardware entropy support of the platform has sufficient 129 performance to support CSRNG then select that. Otherwise, select 130 CTR-DRBG CSPRNG as that is a FIPS140-2 recommended CSPRNG. 131 132config HARDWARE_DEVICE_CS_GENERATOR 133 bool "Use hardware random driver for CS random numbers" 134 depends on ENTROPY_HAS_DRIVER 135 help 136 Enables a cryptographically secure random number generator that 137 uses the enabled hardware random number driver to generate 138 random numbers. 139 140config CTR_DRBG_CSPRNG_GENERATOR 141 bool "Use CTR-DRBG CSPRNG" 142 depends on MBEDTLS 143 depends on ENTROPY_HAS_DRIVER 144 select MBEDTLS_CIPHER_AES_ENABLED 145 help 146 Enables the CTR-DRBG pseudo-random number generator. This CSPRNG 147 shall use the entropy API for an initialization seed. The CTR-DRBG 148 is a FIPS140-2 recommended cryptographically secure random number 149 generator. 150 151config TEST_CSPRNG_GENERATOR 152 bool "Use insecure CSPRNG for testing purposes" 153 depends on TEST_RANDOM_GENERATOR 154 help 155 Route calls to `sys_csrand_get` through `sys_rand_get` to enable 156 libraries that use the former to be tested with ZTEST. 157 158endchoice # CSPRNG_GENERATOR_CHOICE 159 160config CS_CTR_DRBG_PERSONALIZATION 161 string "CTR-DRBG Personalization string" 162 default "zephyr ctr-drbg seed" 163 depends on CTR_DRBG_CSPRNG_GENERATOR 164 help 165 Personalization data can be provided in addition to the entropy 166 source to make the initialization of the CTR-DRBG as unique as 167 possible. 168 169endmenu 170
