HW RNG on dom0?

[Johannes Graumann]

I am wondering whether 
1) under QubesOS a (USB) HW RNG like http://www.bitbabbler.org/ is
usable

and if yes
2) where attaching it would make most sense? sys-net? dom0? Can Xen
VM's be set up to feed on entropy provided by the host?

Thanks for any hint.

Sincerely, Joh

[Jean-Philippe Ouellet]

On Mon, Apr 10, 2017 at 8:23 AM, Johannes Graumann
<nons...@graumannschaft.org> wrote:
> I am wondering whether
> 1) under QubesOS a (USB) HW RNG like http://www.bitbabbler.org/ is usable

Yes. You would need to do some work to make it feed entropy in a safe
way though.

> and if yes
> 2) where attaching it would make most sense? sys-net? dom0?

sys-usb, and have a qrexec service in dom0 to collect entropy from it
and mix in into the dom0 pool, which will eventually propagate to
other VMs.

> Can Xen VM's be set up to feed on entropy provided by the host?

Yes, in fact we already do so.

Discussion:
- https://github.com/QubesOS/qubes-issues/issues/673
- https://groups.google.com/d/topic/qubes-devel/5wI8ygbaohk/discussion

Implementation:
- https://github.com/QubesOS/qubes-core-agent-linux/blob/a69acdabbfb60d88971644cfad50165091a66b9f/init/functions#L95-L101
- https://github.com/QubesOS/qubes-core-admin/blob/19e68bacf22cd965e819dfa4913740ecc14d1c40/core-modules/000QubesVm.py#L1152-L1158

Cheers,
Jean-Philippe