/dev/random on virtual machines

Sun 09 March 2014 by Patrick Pierson

Haveged is a utility built to provide additional entropy for virtual machines. It does so by measuring process time. As a test I ran the following command before installing haveged.

[root@test-pierson ppierson]# cat /dev/random | rngtest -c 1000
rngtest 2
Copyright (c) 2004 by Henrique de Moraes Holschuh
This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or 
FITNESS FOR A PARTICULAR PURPOSE.

rngtest: starting FIPS tests...

10 minutes into it and it’s still sitting at “starting FIPS test” which I can assume is the exact issue I have with virtual machines. No random data is coming from /dev/random so the rngtest doesnt run.

So I killed it and as you see below there was no data being sent from /dev/random

^Crngtest: bits received from input: 9456
rngtest: FIPS 140-2 successes: 0
rngtest: FIPS 140-2 failures: 0
rngtest: FIPS 140-2(2001-10-10) Monobit: 0
rngtest: FIPS 140-2(2001-10-10) Poker: 0
rngtest: FIPS 140-2(2001-10-10) Runs: 0
rngtest: FIPS 140-2(2001-10-10) Long run: 0
rngtest: FIPS 140-2(2001-10-10) Continuous run: 0
rngtest: input channel speed: (min=0.000; avg=0.000; max=0.000)bits/s
rngtest: FIPS tests speed: (min=0.000; avg=0.000; max=0.000)bits/s
rngtest: Program run time: 927713203 microseconds

As another test I ran it against /dev/urandom

root@test-pierson ppierson]# cat /dev/urandom | rngtest -c 1000
rngtest 2
Copyright (c) 2004 by Henrique de Moraes Holschuh
This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or 
FITNESS FOR A PARTICULAR PURPOSE.

rngtest: starting FIPS tests...
rngtest: bits received from input: 20000032
rngtest: FIPS 140-2 successes: 999
rngtest: FIPS 140-2 failures: 1
rngtest: FIPS 140-2(2001-10-10) Monobit: 0
rngtest: FIPS 140-2(2001-10-10) Poker: 0
rngtest: FIPS 140-2(2001-10-10) Runs: 0
rngtest: FIPS 140-2(2001-10-10) Long run: 1
rngtest: FIPS 140-2(2001-10-10) Continuous run: 0
rngtest: input channel speed: (min=3.090; avg=70.285; max=3178.914)Mibits/s
rngtest: FIPS tests speed: (min=4.918; avg=74.942; max=19073.486)Mibits/s
rngtest: Program run time: 604237 microseconds

The “bits received from input” looks to be the key. In /dev/urandom we have 20mbits of input where as /dev/random only has 9kbits.

I installed haveged by running:

yum install haveged

Then ran:

service haveged start
chkconfig haveged on

A re-run against /dev/random finishes almost instantly. Haveged works!!

[root@test-pierson ppierson]# cat /dev/random | rngtest -c 1000
rngtest 2
Copyright (c) 2004 by Henrique de Moraes Holschuh
This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or 
FITNESS FOR A PARTICULAR PURPOSE.

rngtest: starting FIPS tests...
rngtest: bits received from input: 20000032
rngtest: FIPS 140-2 successes: 1000
rngtest: FIPS 140-2 failures: 0
rngtest: FIPS 140-2(2001-10-10) Monobit: 0
rngtest: FIPS 140-2(2001-10-10) Poker: 0
rngtest: FIPS 140-2(2001-10-10) Runs: 0
rngtest: FIPS 140-2(2001-10-10) Long run: 0
rngtest: FIPS 140-2(2001-10-10) Continuous run: 0
rngtest: input channel speed: (min=134.423; avg=4024.522; max=1395089.286)Kibits/s
rngtest: FIPS tests speed: (min=11.293; avg=44.223; max=123.055)Mibits/s
rngtest: Program run time: 5321680 microseconds