<blex>
what is known of the process by which /dev/hwrng gathers entropy
<blex>
some sources claim it is a thermal noise source while others claim it uses avalanche noise
<blex>
not much seems to be known about it
wael has joined ##raspberrypi-internals
Stromeko has quit [Quit: Going… gone.]
Stromeko has joined ##raspberrypi-internals
<bonda_000>
blex: never heard of avalance noise
tarel2 has joined ##raspberrypi-internals
<bonda_000>
thermal kTC noise yeah
<bonda_000>
in image sensors, it is treated as some DC offset
<bonda_000>
when shutter functions, the thermal noise produced by the switching in the sensor, is eliminated by the CDS (Correlated double sampling) technique
<bonda_000>
there is two clocks 90 degrees out of phase, the subtraction is done on the capacitor in the opamp circuit
<bonda_000>
if you go the analog way
<bonda_000>
so it is not like AC noise in my imagination
<tarel2>
Where do you find the specs of the raspberry Pi 400 say? If you really wanted to get into writing code for it?
tarel2 has quit [Quit: Client closed]
purplegiraffe has quit [Remote host closed the connection]
inara` has quit [Ping timeout: 244 seconds]
purplegiraffe has joined ##raspberrypi-internals
inara has joined ##raspberrypi-internals
tarel2 has joined ##raspberrypi-internals
Stromeko has quit [Quit: Going… gone.]
Stromeko has joined ##raspberrypi-internals
ungeskriptet has joined ##raspberrypi-internals
angerisagift has quit [Ping timeout: 260 seconds]
angerisagift has joined ##raspberrypi-internals
bonda_000 has quit [Remote host closed the connection]
bonda_000 has joined ##raspberrypi-internals
tarel2 has quit [Quit: Client closed]
<blex>
bonda_000: is that how the raspberry pi generator works?
<bonda_000>
blex: it's hard to tell their docs omit a lot of high level data, not even worth mentioning low level stuff
<bonda_000>
I gave up trying to ask tech companies provide normally written instruction (datasheet), so I just wait till they end up on the ransomware dump and get the full document as it should be free
<bonda_000>
or worse:)
<bonda_000>
go and get it myself
<bonda_000>
Saying, I sell you a "laundry machine" but to obtain full instruction you need to go extra lengths, is ransomware by itself
<bonda_000>
because bcm2835 datasheet is just a big joke if you ever tried reading it
<bonda_000>
it was written like in the smoking circle during the smoke break
<bonda_000>
a fifth grader would be more punctual I believe
<blex>
bonda_000: so how do we find out what makes the bcm rng work
<blex>
it could be anything
<blex>
could aes cipher running over zeros
<bonda_000>
you get a @corporatedomain.com email
<bonda_000>
message them, sign NDA, they give you full instruction
<bonda_000>
thats the only way I think, because if you try to reverse engineer it, look up the comment in the top, you are violating the law
<bonda_000>
combining "this" and any kind of "that" of Broadcom is prohibited
<bonda_000>
I guess you just take it as granted like the camera block, its a black box that works
hackkitten has quit [Remote host closed the connection]
hackkitten has joined ##raspberrypi-internals
<bonda_000>
its a very shitty asic, that has no CLK_IN which does not allow it to be used in many applications
<bonda_000>
no CLK_IN - not able to synchronize it with another master device
<bonda_000>
I guess the new one, has that, 2040 or whatever
<clever>
bonda_000: from what the rpi engineers have said on the forums, there isnt really any proper documentation for half of these SoC's
<clever>
its just email history and asking other engineers
<clever>
so the problem is both investing time into collecting that all into one place, and running it by lawyers to know what it good to release
<bonda_000>
for example SMI, is mentioned, but has no chapter in the datasheet, the instruction is literally ascii art in one of the .h files
<clever>
i talked to the guy who wrote that linux driver
<clever>
all he got was the register definition and a rough description
<clever>
he had to brute-force it to get the rest
<clever>
i think he made that ascii-art after figuring it out
<jn>
the best decision in the history of Raspberry Pi was to do a project without Broadcom for once
<clever>
yeah, with the rp2040, they arent bound by broadcom anymore
<clever>
but the RP1 shows that they can still keep secrets
<clever>
large chunks of the RP1 arent documented well, and thats entire rpi designed
<bonda_000>
they use a gighertz differntial transceiver as 1 bit ADC
<bonda_000>
which works for certain rf modulations like PSK
<bonda_000>
the phase shifted, frequency shifted all supposedly works with this one
<bonda_000>
because all you really need is to measure when it crosses zero
<bonda_000>
as the data is encoded in the frequencies(FSK), or phase shifts(PSK) not the amplitude
bonda_000 has quit [Remote host closed the connection]
bonda_000 has joined ##raspberrypi-internals
shm_tb has joined ##raspberrypi-internals
Avron has quit [Ping timeout: 244 seconds]
Avron has joined ##raspberrypi-internals
Avron has quit [Ping timeout: 260 seconds]
Avron_ has joined ##raspberrypi-internals
bonda_000 has quit [Remote host closed the connection]
bonda_000 has joined ##raspberrypi-internals
shm_tb has quit [Read error: Connection reset by peer]
shm_tb has joined ##raspberrypi-internals
shm_tb has quit [Remote host closed the connection]
Stromeko has quit [Quit: Going… gone.]
Stromeko has joined ##raspberrypi-internals
shm_tb has joined ##raspberrypi-internals
shm_tb has quit [Read error: Connection reset by peer]
shm_tb has joined ##raspberrypi-internals
<blex>
it's not asking for much knowing how the /dev/hwrng produces random numbers or what principle it uses to make them
<blex>
i am really surprised this is kept secret
<blex>
no one trusts a black box
<clever>
blex: and neither does linux, it only uses that to scramble the prng more, and the prng does the real rng generation
shm_tb has quit [Ping timeout: 276 seconds]
<bonda_000>
I dont have the decompile anymore, it was probably the videocore module
<bonda_000>
it was actually a horrible accident, on my side, some askUbuntu command has ruined grub on my debian build and I just wiped the disk
<bonda_000>
don't run anything grub-related unless you know exactly what you are doing, it will render your system BSOD
<bonda_000>
so the videocore patch to ghidra is gone
tarel2 has joined ##raspberrypi-internals
<bonda_000>
clever: are you into hacking at all?
<tarel2>
What up clever?
<bonda_000>
clever: I have a nmap of 1000 open ports of some machine that runs something like Veritas or Kubes virtualization-like stuff https://pastebin.com/UK1adQn6
<bonda_000>
windows services but also X11 desktop
<bonda_000>
but thats `nmap -Pn -sT`, `nmap -Pn -sV` on each of these tells me they are all filtered, so it won't talk at all about each particular service
<tarel2>
Do they actually ever released the specs on something like the pi 4
<bonda_000>
Hawaii, Rhea and one other architecture had the same BCM chip that Raspberry Pi uses
<bonda_000>
so these drivers also apply to Raspberry Pi
jcea has quit [Read error: Connection reset by peer]
jcea has joined ##raspberrypi-internals
<bonda_000>
Arm True Random Number Generator (TRNG) configuration parameters specify the settings of the internal ring-oscillator lengths, and the output sampling rate. The parameters are device-specific. Each silicon process has different noise and jitter characteristics. The specific SoC layout affects these characteristics. Therefore, the TRNG behavior must be characterized on the actual silicon of the device to determine the most
<bonda_000>
suitable parameters. Characterizing in this way ensures that the TRNG output has maximal entropy.Characterization must be performed during the initial post-silicon testing of the device, or whenever substantial changes are made. For example, after changes to process or respins.
<bonda_000>
Note
<bonda_000>
Usually, the physical process used for collecting entropy is an inverter timing jitter that is collected from a dedicated on-chip free-running ring oscillator.
<bonda_000>
if they are signed with ARM, that's what they most likely have