random generator

[Donny Jekels]

Does any know if HP is ever going to include a random number generator is the OS?

[A. Clay Stephenson]

The KRNG11i package is a free download from HP for 11i.

[A. Clay Stephenson]

Here's the URL:

http://software.hp.com/portal/swdepot/displayProductInfo.do?productNumber=KRNG11I

[Sridhar Bhaskarla]

Hi ,

Yep. It's already there with 11i. You can get it from

http://software.hp.com/portal/swdepot/displayProductInfo.do?productNumber=KRNG11I

It needs a reboot of the system.

-Sri

[Donny Jekels]

thank you, nothing for 11.0 or 11i.v2?

[Sridhar Bhaskarla]

Hi Donny,

Look at PRNGD. I by mistake posted the response in one of bookmarked threads :-).

http://hpux.cs.utah.edu/hppd/hpux/Maths/Misc/prngd-0.9.26/

This doesn't have a device file associated with it but can feed the random data to programs like Openssl etc.,

-Sri

[Donny Jekels]

I am trying to compile openssh 3.8p1 on a 11.0 box and the configure script is stuck for over an hour on this


checking whether OpenSSL's PRNG is internally seeded...

any ideas?

[Sridhar Bhaskarla]

Can you post the error you are getting?. I don't believe seeding is required for the compilation.

-Sri

[Sridhar Bhaskarla]

Hi,

Try this if it works. I did it to generate ssl self-signed certificates when it was complaining about PRNG seeding.

Copy and compress any file like swagent.log as say randfile.Z and run the command

openssl genrsa -des3 -rand randfile.Z -out my.key 1024

This should create a file called .rnd in the home directory.

That should help ssl to seed.

-Sri

[Donny Jekels]

0 semi-random bytes loaded
Generating RSA private key, 1024 bit long modulus
2134:error:24064064:random number generator:SSLEAY_RAND_BYTES:PRNG not seeded:md_rand.c:503:You need to read the OpenSSL FAQ, http://www.openssl.org/support/faq.html
2134:error:04069003:rsa routines:RSA_generate_key:BN lib:rsa_gen.c:182:

[Sridhar Bhaskarla]

It says "0 semi-random bytes loaded". Looks like your file specified with -rand option is empty. It is working fine with my openssl version 0.9.6e.

-Sri

[Sridhar Bhaskarla]

Make sure the file randfile.Z is in the working directory or specify full path to it while you run the openssl command. The error indicates that it couldn't locate the source. my.key is just file that gets created you can delete it. In that process .rnd gets created which would be used by openssl to seed.

-Sri

[Donny Jekels]

shri,

still having problems with ssl seeding.

how large should the random.Z be? and
where should the key file land up so the ssl know where to find it?

[Sridhar Bhaskarla]

You can just follow these commands.

#cp /var/adm/sw/swagent.log /tmp/randfile
#compress /tmp/randfile
#/wherever_openssl_is/bin/openssl -des3 -rand /tmp/randfile.Z -out my.key 1024

See if that works.

-Sri

[Donny Jekels]

# /usr/local/bin/openssl -des3 -rand /tmp/randfile.Z -out my.key 1024
openssl:Error: '-des3' is an invalid command.

[Donny Jekels]

genrsa was missing. hold thumbs

[Donny Jekels]

checking OpenSSL header version... 90704f (OpenSSL 0.9.7d 17 Mar 2004)
checking OpenSSL library version... 90704f (OpenSSL 0.9.7d 17 Mar 2004)
checking whether OpenSSL's headers match the library... yes
checking whether OpenSSL's PRNG is internally seeded...

this is where it stops, no luck with all the work arounds in place.

I compiled EGD random number generator - this is in place and running.

was able to generate my.key file with openssl

still compiling ssh tries to see if ssl can seed itself and get stuck


# tusc 10828
( Attached to process 10828 ("./conftest") [32-bit] )
In user-mode ................................................................ [running]

[Sridhar Bhaskarla]

Donny,

With the following options, I could be able to run 'configure' successfully.

./configure --prefix=/opt/openssh2 --with-zlib=/opt/zlib --with-ssl-dir=/opt/openssl --with-pam --with-tcp-wrappers=../tcp_wrappers_7.6 --with-privsep-path=/opt/openssh2/var/empty --with-pid-dir=/opt/openssh2/var

It basically compiles a small C program and runs it to find the capability of openssl seeding.

You should be able to find where it is hanging once you put the 'set -x' flag in the configure script.

-Sri

[Donny Jekels]

this tusc output for the conftest c file

sigsetreturn(0x7f7d0d4e, 0x6211988, 1392) ................................... = 0
getpid() .................................................................... = 7677 (7676)
getpid() .................................................................... = 7677 (7676)
open("/dev/urandom", O_RDONLY|O_NONBLOCK|O_NOCTTY, 02277) ................... ERR#2 ENOENT
open("/dev/random", O_RDONLY|O_NONBLOCK|O_NOCTTY, 0134000) .................. ERR#2 ENOENT
open("/dev/srandom", O_RDONLY|O_NONBLOCK|O_NOCTTY, 0134000) ................. ERR#2 ENOENT
socket2(1, 1, 0) ............................................................ = 3
connect(3, 0x7f7f0cf0, 19) .................................................. = 0
write(3, "01 ", 2) ......................................................... = 2
read(3, " ", 1) ............................................................ = 1
read(3, "ceQ N ) 7 a4caceb019\f< b303d8 ".., 32) ........................... = 32
close(3) .................................................................... = 0
In user-mode ................................................................ [running]

[H.Merijn Brand (procura]

/dev/random for 11.00 available on http://freshmeat.net/projects/hpux11-random/
works furrrrfect :)

Enjoy, Have FUN! H.Merijn

[H.Merijn Brand (procura]

/dev/random for 11.00 available on http://freshmeat.net/projects/hpux11-random/
works purrrrfect :)

Enjoy, Have FUN! H.Merijn

[Sridhar Bhaskarla]

Hi,

I wonder if you could be able to successfully compile openssl. It works just fine for me on 11.0 box without any random generators. It says no and configures it. Another idea is to supply --with-rand-helper as the configure option.

You could try replacing the entire C-program testing area (lines 9624 - 9667)with the two lines, because we know that the ssl is not internally seeded for 11.0.

echo "$as_me:9659: result: no" >&5
USE_RAND_HELPER=yes

Take a copy of your configure script before you do so.

-Sri

[Donny Jekels]

procura, were you able to install this random device on 11.i?

[Donny Jekels]

sri,

I am going to try the c file editing after i test the device file from freshmeat.

keep you posted.

[H.Merijn Brand (procura · Accepted solution]

11i doesn't need this, it is available from HP sources, if not already installed in recent 11i shipments. Follow the links presented by others.

The link I posted is for 11.00 only, and as said, works as a charm

You asked for 11.00 and 10.20 too. I never was able to find this for 10.20, but on 10.20 I use egd.pl instead. Works OK, but needs restarting after reboot, whereas the 11.00 solution is builtin module.

Enjoy, Have FUN! H.Merijn