mirror of
https://github.com/apache/nuttx.git
synced 2026-08-01 20:28:58 +00:00
9e467388de
The existing first-order LCG (seed = 470001 * seed % 999563) has several quality problems: - Output range limited to [1, 999562] (~20 bits) instead of full 32-bit - Lower bits have very short periods (8-bit period = 1, 16-bit = 105) - Overall period only ~1M, far too short for many applications - Causes mbedtls_rsa_gen_key to loop forever when rand() consumption aligns with the cycle length (issue #16760) Replace the entire order-based LCG implementation (CONFIG_LIBC_RAND_ORDER 0-3) with Marsaglia's xorshift32: - Full 32-bit output range - Period 2^32 - 1 (~4.29 billion) - Fast: just three XOR/shift operations - No floating-point math needed - No CONFIG_LIBC_RAND_ORDER configuration required Remove the CONFIG_LIBC_RAND_ORDER Kconfig option and clean up all defconfig references (12 boards) and related comments. Signed-off-by: hanzhijian <hanzhijian@zepp.com>
147 lines
3.6 KiB
Text
147 lines
3.6 KiB
Text
#
|
|
# For a description of the syntax of this configuration file,
|
|
# see the file kconfig-language.txt in the NuttX tools repository.
|
|
#
|
|
|
|
config ARCH_HAVE_RNG
|
|
bool
|
|
|
|
config DEV_RANDOM
|
|
bool "Enable /dev/random"
|
|
default y
|
|
depends on ARCH_HAVE_RNG
|
|
---help---
|
|
Enable support for /dev/random provided by a hardware TRNG.
|
|
|
|
config DEV_URANDOM
|
|
bool "Enable /dev/urandom"
|
|
default n
|
|
---help---
|
|
Enable support for /dev/urandom provided by either a hardware TRNG or
|
|
by a software PRNG implementation.
|
|
|
|
NOTE: This option may not be cryptographially secure and should not
|
|
be enabled if you are concerned about cyptographically secure
|
|
pseudo-random numbers (CPRNG) and do not know the characteristics
|
|
of the software PRNG implementation!
|
|
|
|
if DEV_URANDOM
|
|
|
|
choice
|
|
prompt "/dev/urandom algorithm"
|
|
default DEV_URANDOM_ARCH if ARCH_HAVE_RNG
|
|
default DEV_URANDOM_XORSHIFT128 if !ARCH_HAVE_RNG
|
|
|
|
config DEV_URANDOM_XORSHIFT128
|
|
bool "xorshift128"
|
|
---help---
|
|
xorshift128 is a pseudorandom number generator that is simple,
|
|
portable, and can also be used on 8-bit and 16-bit MCUs.
|
|
|
|
NOTE: Not cyptographically secure
|
|
|
|
config DEV_URANDOM_CONGRUENTIAL
|
|
bool "Congruential"
|
|
---help---
|
|
Use the same PRNG used with srand()/rand(). Uses the system
|
|
random number generator (xorshift32).
|
|
|
|
NOTE: Not cryptographically secure
|
|
|
|
config DEV_URANDOM_RANDOM_POOL
|
|
bool "Entropy pool"
|
|
depends on CRYPTO_RANDOM_POOL
|
|
---help---
|
|
Use the entropy pool CPRNG output for urandom algorithm.
|
|
|
|
NOTE: May or may not be cyptographically secure, depending upon the
|
|
quality entropy available to entropy pool.
|
|
|
|
config DEV_URANDOM_ARCH
|
|
bool "Architecture-specific"
|
|
depends on ARCH_HAVE_RNG
|
|
---help---
|
|
The implementation of /dev/urandom is provided in archtecture-
|
|
specific logic using hardware TRNG logic. architecture-specific
|
|
logic must provide the whole implementation in this case, including
|
|
the function devurandom_register(). In this case, /dev/urandom may
|
|
refer to the same driver as /dev/random.
|
|
|
|
NOTE: May or may not be cyptographically secure, depending upon the
|
|
implementation.
|
|
|
|
endchoice # /dev/urandom algorithm
|
|
|
|
endif # DEV_URANDOM
|
|
|
|
menuconfig DEV_SE05X
|
|
bool "Enable secure element (SE05X)"
|
|
depends on I2C
|
|
depends on CRYPTO
|
|
default n
|
|
---help---
|
|
Enable support for /dev/se05x secure element provided by NXP SE050
|
|
or SE051
|
|
|
|
if DEV_SE05X
|
|
|
|
choice
|
|
prompt "Channel communication interface"
|
|
default DEV_SE05X_PLAIN
|
|
---help---
|
|
Select authentication method
|
|
|
|
config DEV_SE05X_SCP03
|
|
bool "SCP03 secure channel (TBI)"
|
|
select CRYPTO_RANDOM_POOL
|
|
select CRYPTO_AES
|
|
|
|
config DEV_SE05X_PLAIN
|
|
bool "plain communication"
|
|
|
|
endchoice # Channel communication interface
|
|
|
|
config DEV_SE05X_SCP03_KEY_FILE
|
|
string "SCP03 keys"
|
|
depends on DEV_SE05X_SCP03
|
|
default "/host/path/to/key_file"
|
|
---help---
|
|
Specify file containing the keys needed with SCP03 channel authentication.
|
|
Location may be relative to the NuttX root folder. File should contain
|
|
the definitions for SCP03_ENC_KEY, SCP03_MAC_KEY and SCP03_DEK_KEY as
|
|
byte array initializers.
|
|
|
|
choice SE05X_LOG_LEVEL
|
|
prompt "SE05x debug log level"
|
|
default SE05X_LOG_NONE
|
|
---help---
|
|
The SE05x log is divided into the following levels: ERROR,WARNING,INFO,DEBUG.
|
|
|
|
config SE05X_LOG_NONE
|
|
bool "No output"
|
|
|
|
config SE05X_LOG_ERROR
|
|
bool "Error"
|
|
|
|
config SE05X_LOG_WARNING
|
|
bool "Warning"
|
|
|
|
config SE05X_LOG_INFO
|
|
bool "Info"
|
|
|
|
config SE05X_LOG_DEBUG
|
|
bool "Debug"
|
|
|
|
endchoice # SE05x debug log level
|
|
|
|
endif #DEV_SE05X
|
|
|
|
config DEV_RNG90
|
|
bool "Enable Microchip RNG90 TRNG"
|
|
depends on I2C
|
|
depends on CRYPTO
|
|
default n
|
|
---help---
|
|
Enable support for /dev/rng90 random number generator provided by
|
|
Microchip RNG90 TRNG.
|
|
|