Linux and SP800-90B Compliance (N12b)
Starting on November 7, 2020, FIPS 140-2 validations require that noise sources seeding Deterministic Random Bit Generators (DRBGs) must be compliant to NIST Special Publication (SP) 800-90B, “Recommendation for the Entropy Sources Used for Random Bit Generation.” FIPS 140-2 modules that execute on a Linux environment commonly obtain their seeds from the Linux kernel device driver for random numbers: /dev/random, /dev/urandom or the getrandom system call. This implies that SP800-90B compliance is mandated for the Linux kernel random number generator. Compliance with SP800-90B is vital as otherwise all FIPS 140-2 modules executing on Linux, and providing ciphers using random numbers, cannot be claimed to be approved ciphers any more. Therefore, a study on whether and how Linux complies with SP800-90B is required to conclude how FIPS 140-2 modules are affected. Such a study will be presented analyzing the status quo and deriving instructions for FIPS 140-2 modules to use SP800-90B compliant noise sources. Such qualitative instructions are supplemented with guidance on how the quantitative testing mandated by SP800-90B can be conducted to provide all necessary data and analysis required to complete a FIPS 140-2 validation.