Using Qrypt's Quantum Entropy in RNG Tools

rng-tools is a utility that allows you to inject entropy from hardware sources, prngs, and http streams into system devices. Qrypt's Quantum Entropy service is a random source option in rng-tools, allowing you to inject quantum entropy into system devices such as /dev/random, /dev/urandom, and user-defined nodes or files.

This service requires an access token. Follow the steps in Getting Started to obtain an access token.

More information about rng-tools can be found on the rng-tools Github and the rng-tools wiki page.

---

Installation

To use Qrypt's Quantum Entropy service in rng-tools, rng-tools must be installed and configured.

Clone the latest rng-tools master from GitHub.

git clone https://github.com/nhorman/rng-tools

Install rng-tools dependencies. Additional packages may be required, depending on linux distro. The configure script below will name any missing packages it encounters.

sudo apt install \
    make \
    libtool \
    libxml2-dev \
    libssl-dev \
    libcurl3-dev \
    libp11-dev \
    librtlsdr-dev \
    libusb-1.0-0-dev \
    libjansson-dev \
    libcap-dev

Add --disable-dependency-tracking to the ./configure command if needed.

./autogen.sh
./configure
make
sudo make install

Verify installation.

which rngd

Command Line Usage

The resulting rngd executable can run directly to start either a daemon or a foreground process. By default, rngd will run as a background daemon and attempt to use the hwrng, errand, pkcs11, and rtlsdr random sources.

To run rngd using exclusively Qrypt's Quantum Entropy, run the following command. This will run rngd as a foreground process with the Qrypt source enabled and all other entropy sources disabled. rngd will send its random to the /dev/random device.

Note that sudo is needed in the command because rngd accesses the root folder.

sudo rngd -f -x hwrng -x rdrand -x pkcs11 -x rtlsdr -n qrypt -O qrypt:tokenfile:<qrypt token path>

Command line options:

Option	Description
-f	Run rngd as a foreground process. If omitted, rngd will run as a background daemon
-o <path>	Device or file for the random number output. Defaults to /dev/random
-x <source>	Disables the specified source. For example, -x hwrng
-n <source>	Enables the specified source. For example, -n qrypt
-O <source>:<key>:<value>	Sets a source specific configuration option. For example, -O qrypt:tokenfile:/etc/rngd/qrypt.token

Service Usage

rng-tools comes with a rngd.service file for setting up a systemd service. To configure rngd to automatically start the Qrypt source on boot, follow these steps:

Save your Qrypt api token to a system-accessible directory, such as /etc/rngd/qrypt.token. Then, edit rngd.service to add Qrypt arguments and options.

Note that sudo is needed in the subsequent commands because rngd accesses the root folder.

[Unit]
Description=Hardware RNG Entropy Gatherer Daemon
ConditionVirtualization=!container

# The '-f' option is required for the systemd service 'rngd' to work with Type=simple
[Service]
Type=simple
ExecStart=<rngd install path> -f -x hwrng -x rdrand -x pkcs11 -x rtlsdr -n qrypt -O qrypt:tokenfile:<qrypt token path>
SuccessExitStatus=66

[Install]
WantedBy=multi-user.target

Copy the rngd service to systemd.

sudo cp rngd.service /etc/systemd/system/rngd.service
sudo chmod 644 /etc/systemd/system/rngd.service

Start the rngd service.

sudo systemctl daemon-reload
sudo systemctl start rngd

Verify the rngd service is running properly.

sudo systemctl status rngd

Enable the rngd service for it to start on system boot.

sudo systemctl enable rngd