Using OneRNG hardware RNG can I get wireguard to use /dev/random

Using OneRNG hardware RNG can I get wireguard to use /dev/random

[peter garner]

Hi List, 

Platform: Raspberry Pi4B, Raspbian Buster 10.  This device dedicated to
wireguard. uname -a: Linux wireguard 4.19.118-v7l+ #1311 SMP Mon Apr 27
14:26:42 BST 2020 armv7l GNU/Linux. wg-quick is dated May 22 08:11
 
I've used my OneRNG v3.0 external device to recreate my SSH moduli and
am now looking to recreate my wireguard keys.

According to the Wireguard docs it uses /dev/urandom:
https://gist.github.com​/rmoriz​/58f1768218a4fbc4b318615bfb85111d
 
fd = open("/dev/urandom", O_RDONLY);
	if (fd < 0)
		return fd;
	ret = read(fd, out, len);
	close(fd);
 
The OneRNG utilises /dev/random though - is there any way I can get
wireguard to use /dev/random instead (without recompiling) ?

Re: Using OneRNG hardware RNG can I get wireguard to use /dev/random

[Jeffrey Walton]

On Fri, Jul 24, 2020 at 4:28 AM peter garner <peter@petergarner.net> wrote:
>
> I've used my OneRNG v3.0 external device to recreate my SSH moduli and
> am now looking to recreate my wireguard keys.
>
> According to the Wireguard docs it uses /dev/urandom:
> https://gist.github.com/rmoriz/58f1768218a4fbc4b318615bfb85111d
>
> fd = open("/dev/urandom", O_RDONLY);
>         if (fd < 0)
>                 return fd;
>         ret = read(fd, out, len);
>         close(fd);

Unrelated, the kernel-crypto folks recommend using /dev/urandom.
Wiregaurd is following best practices. Also see
https://lkml.org/lkml/2017/7/20/993.

Jeff

Re: Using OneRNG hardware RNG can I get wireguard to use /dev/random

[Jason A. Donenfeld]

On Fri, Jul 24, 2020 at 10:27 AM peter garner <peter@petergarner.net> wrote:
>
> Hi List,
>
> Platform: Raspberry Pi4B, Raspbian Buster 10.  This device dedicated to
> wireguard. uname -a: Linux wireguard 4.19.118-v7l+ #1311 SMP Mon Apr 27
> 14:26:42 BST 2020 armv7l GNU/Linux. wg-quick is dated May 22 08:11
>
> I've used my OneRNG v3.0 external device to recreate my SSH moduli and
> am now looking to recreate my wireguard keys.
>
> According to the Wireguard docs it uses /dev/urandom:
> https://gist.github.com/rmoriz/58f1768218a4fbc4b318615bfb85111d
>
> fd = open("/dev/urandom", O_RDONLY);
>         if (fd < 0)
>                 return fd;
>         ret = read(fd, out, len);
>         close(fd);
>
> The OneRNG utilises /dev/random though - is there any way I can get
> wireguard to use /dev/random instead (without recompiling) ?

We're not going to change the wireguard-tools source for this.

But if you need to hijynx it, just use mknod to make /dev/urandom
point to the same device node as /dev/random. I'd recommend finding a
better solution, however, to whatever randomness situation you have
going on.

Re: Using OneRNG hardware RNG can I get wireguard to use /dev/random

[Ipad@petergarner.net]

>> On 24 Jul 2020, at 09:33, Jeffrey Walton <noloader@gmail.com> wrote:
>> 
>> On Fri, Jul 24, 2020 at 4:28 AM peter garner <peter@petergarner.net> wrote:
>> I've used my OneRNG v3.0 external device to recreate my SSH moduli and
>> am now looking to recreate my wireguard keys.
>> According to the Wireguard docs it uses /dev/urandom:
>> https://gist.github.com/rmoriz/58f1768218a4fbc4b318615bfb85111d
>> fd = open("/dev/urandom", O_RDONLY);
>>       if (fd < 0)
>>               return fd;
>>       ret = read(fd, out, len);
>>       close(fd);
> 
> Unrelated, the kernel-crypto folks recommend using /dev/urandom.
> Wiregaurd is following best practices. Also see
> https://lkml.org/lkml/2017/7/20/993.
> 
> Jeff

Thanks Jeff - all is now clear (that link helped as well). I've been doing some additional research and everything makes sense.