Haveged: Boosting Entropy on Embedded Linux

G5 Cyber Security

2 months ago

TL;DR

Yes, Haveged can significantly improve entropy generation on embedded Linux devices, making your pseudo-random number generator (PRNG) more unpredictable and closer to a true random number generator (TRNG). This is especially useful for headless systems lacking sufficient environmental noise. However, it’s not a replacement for hardware TRNGs where security is paramount.

What is Entropy?

Entropy represents the randomness available in a system. A good PRNG needs enough entropy to seed itself and produce unpredictable numbers. Embedded systems often struggle with this because they lack sources of environmental noise like mouse movements, keyboard presses, or network activity found on desktop computers.

What is Haveged?

Haveged (Hardware Entropy Gatherer) is a daemon that collects entropy from hardware timing variations. It’s designed to be lightweight and suitable for embedded systems. It doesn’t *create* randomness, but it extracts what little exists in the system and makes it available to the kernel.

Steps to Install and Configure Haveged

Install Haveged: Use your distribution’s package manager.
- Debian/Ubuntu:
```
sudo apt update && sudo apt install haveged
```
- Fedora/CentOS/RHEL:
```
sudo dnf install haveged
```
- Arch Linux:
```
sudo pacman -S haveged
```
Start and Enable the Service: Ensure Haveged starts automatically on boot.
```
sudo systemctl start haveged
```
```
sudo systemctl enable haveged
```
Verify Haveged is Running: Check its status.
```
sudo systemctl status haveged
```
Look for a line indicating the service is active (running).
Check Entropy Availability: Use /dev/urandom to test entropy. Note that reading directly from /dev/random will block if insufficient entropy is available.
```
head -c 10 /dev/urandom | hexdump -C
```
Repeat this command several times and observe the output. Haveged should increase the speed at which random data is generated compared to before installation, especially on a headless system.
Configure Haveged (Optional): The default configuration usually works well, but you can adjust it in /etc/haveged.conf.
- Daemon Mode: Ensure the daemon is running as expected.
- Entropy Source: While generally automatic, you can specify a different entropy source if needed (advanced users only).
- Data Rate Limit: Adjust the rate at which Haveged feeds entropy to the kernel if necessary. Be cautious about increasing this too much as it could impact system performance.

Monitoring and Considerations

Regularly Monitor: Check /proc/sys/kernel/random/entropy_avail to see the current entropy pool size.
Not a TRNG Replacement: Haveged improves PRNG quality but doesn’t provide true randomness. For high-security applications, use a hardware TRNG if possible.
System Load: Monitor CPU usage after installing Haveged to ensure it’s not significantly impacting performance on resource-constrained embedded devices.
Kernel Configuration: Ensure your kernel is configured to utilize entropy sources correctly. This is usually the default, but check if you’ve made custom kernel modifications.