imported>Hehua：加入{{Rough translation}}标记

2023-07-13T03:41:24Z

新页面

{{Rough translation|time=2023-07-13T03:41:24+00:00}}
{{NoteTA
|G1=IT
}}
'''<code>RDRAND</code>'''（之前被称为'''Bull Mountain'''<ref>{{cite web
|url = http://software.intel.com/en-us/blogs/2011/06/22/find-out-about-intels-new-rdrand-instruction
|title = Find out about Intel's new RdRand Instruction.
|last = Hofemeier
|first = Gael
|date = 2011-06-22
|website = Intel Developer Zone Blogs
|publisher =
|accessdate = December 2013
|archive-date = 2017-09-26
|archive-url = https://web.archive.org/web/20170926235822/https://software.intel.com/en-us/blogs/2011/06/22/find-out-about-intels-new-rdrand-instruction
|dead-url = no
}}</ref>）是一个计算机指令，用于从[[芯片]]上的[[硬件随机数生成器]]中获取[[随机数]]。所用到的随机数生成器由芯片上的[[熵]]池初始化。<ref name=SIG>{{cite web | title = Intel Digital Random Number Generator (DRNG): Software Implementation Guide, Revision 1.1 | publisher = [[英特尔]] | date = 2012-08-07 | url = http://software.intel.com/sites/default/files/m/d/4/1/d/8/441_Intel_R__DRNG_Software_Implementation_Guide_final_Aug7.pdf | format = PDF | accessdate = 2012-11-25 | archive-date = 2013-05-18 | archive-url = https://www.webcitation.org/6GhG1P7iR?url=http://software.intel.com/sites/default/files/m/d/4/1/d/8/441_Intel_R__DRNG_Software_Implementation_Guide_final_Aug7.pdf | dead-url = no }}</ref> <code>RDRAND</code>指令在{{tsl|en|Ivy Bridge|}}架构处理器上可用{{Efn|在一些版本的Ivy Bridge结构处理器上，由于一个bug，RdRand指令会导致一个非法指令异常<ref>{{cite book|title=Desktop 3rd Generation Intel Core Processor Family, Specification Update|date=January 2013|publisher=Intel Corporation|url=http://www.intel.com/content/dam/www/public/us/en/documents/specification-updates/3rd-gen-core-desktop-specification-update.pdf|access-date=2017-09-26|archive-date=2018-01-01|archive-url=https://web.archive.org/web/20180101024153/https://www.intel.com/content/dam/www/public/us/en/documents/specification-updates/3rd-gen-core-desktop-specification-update.pdf|dead-url=no}}</ref>|group="note"}}，该指令也是[[X86-64]]和[[IA-32]][[指令集]]的一部分。AMD在2015年6月添加了对<code>RdRand</code>指令的支持。<ref>{{cite web
|url = http://support.amd.com/TechDocs/24594.pdf
|title = AMD64 Architecture Programmer’s Manual Volume 3: General-Purpose and System Instructions
|date = June 2015
|website = AMD Developer Guides, Manuals & ISA Documents
|publisher =
|accessdate = 16 October 2015
|archive-date = 2017-12-22
|archive-url = https://web.archive.org/web/20171222094421/https://support.amd.com/TechDocs/24594.pdf
|dead-url = no
}}</ref>

该随机数生成器要遵守安全标准和加密标准，比如{{tsl|en|NIST SP 800-90A|}}，<ref name="SP800-90">{{cite web |last=Barker |first=Elaine |last2=Kelsey |first2=John |title=Recommendation for Random Number Generation Using Deterministic Random Bit Generators |url=http://csrc.nist.gov/publications/nistpubs/800-90A/SP800-90A.pdf |publisher=[[國家標準技術研究所]] |date=January 2012 |format=PDF |accessdate=September 16, 2013 |archive-date=2013-10-09 |archive-url=https://web.archive.org/web/20131009210654/http://csrc.nist.gov/publications/nistpubs/800-90A/SP800-90A.pdf |dead-url=no }}</ref> {{tsl|en|FIPS 140-2|}}和 [[ANSI X9.82]]。<ref name=SIG /> Intel也在1999年和2012年请密码学研究 Cryptography Research 公司来审查这个随机数发生器，并产生了两篇论文：1999年的 ''The Intel Random Number Generator''<ref>{{cite web
|url = http://www.cryptography.com/public/pdf/IntelRNG.pdf
|title = The Intel Random Number Generator
|last = Jun
|first = Benjamin
|last2 = Kocher
|first2 = Paul
|date = 1999-04-22
|website = Cryptography Research, Inc.
|publisher =
|accessdate = 2015-08-21
|archive-date = 2015-02-13
|archive-url = https://web.archive.org/web/20150213065855/http://www.cryptography.com/public/pdf/IntelRNG.pdf
|dead-url = yes
}}</ref> 和2012年的 ''Analysis of Intel's Ivy Bridge Digital Random Number Generator''<ref>{{cite web
|url = https://www.cryptography.com/public/pdf/Intel_TRNG_Report_20120312.pdf
|title = Analysis of Intel's Ivy Bridge Digital Random Number Generator
|last = Hamburg
|first = Mike
|last2 = Kocher
|first2 = Paul
|last3 = Marson
|first3 = Mark
|date = 2012-03-12
|website = Cryptography Research, Inc.
|publisher =
|accessdate = 2015-08-21
|deadurl = yes
|archiveurl = https://web.archive.org/web/20141230024150/http://www.cryptography.com/public/pdf/Intel_TRNG_Report_20120312.pdf
|archivedate = 2014-12-30
}}</ref>。

'''<code>RDSEED</code>'''和<code>RDRAND</code>类似，也提供了访问硬件熵池的高级方法。
[[Broadwell微架構|Intel Broadwell 系列的CPU]]<ref>{{cite web
|url = https://software.intel.com/en-us/articles/introduction-to-intel-aes-ni-and-intel-secure-key-instructions
|title = Introduction to Intel AES-NI and Intel SecureKey Instructions
|last = Hofemeier
|first = Gael
|date = 2012-07-26
|website = Intel Developer Zone
|publisher = Intel
|accessdate = 2015-10-24
|archive-date = 2015-11-04
|archive-url = https://web.archive.org/web/20151104222751/https://software.intel.com/en-us/articles/introduction-to-intel-aes-ni-and-intel-secure-key-instructions
|dead-url = no
}}</ref> 和 [[AMD Zen|AMD Zen 系列的CPU]]<ref>{{Cite web|title = AMD Starts Linux Enablement On Next-Gen "Zen" Architecture - Phoronix|url = https://www.phoronix.com/scan.php?page=news_item&px=AMD-Zen-CPU-Znver1|website = www.phoronix.com|accessdate = 2015-10-25|archive-date = 2017-03-08|archive-url = https://web.archive.org/web/20170308012816/http://www.phoronix.com/scan.php?page=news_item&px=AMD-Zen-CPU-Znver1|dead-url = no}}</ref>都支持<code>RDSEED</code>生成器和<code>rdseed</code>指令。

== 概略 ==
在[[AMD]]和[[Intel]]的CPU上，<code>[[CPUID]]</code>指令都可以检测[[中央处理器]]（CPU）是否支持<code>RDRAND</code> 指令。如果支持，调用CPUID的标准函数<code>01H</code>之后，ECX寄存器的第30位会被设置成1<ref>{{cite web|title=Volume 1, Section 7.3.17, 'Random Number Generator Instruction'|url=http://download.intel.com/products/processor/manual/325462.pdf|work=Intel® 64 and IA-32 Architectures Software Developer’s Manual Combined Volumes: 1, 2A, 2B, 2C, 3A, 3B and 3C|publisher=Intel Corporation|accessdate=24 June 2013|authorlink=Intel Corporation|page=177|date=June 2013|quote=All Intel processors that support the RDRAND instruction indicate the availability of the RDRAND instruction via reporting CPUID.01H:ECX.RDRAND[bit 30] = 1|archive-date=2013-11-04|archive-url=https://web.archive.org/web/20131104062923/http://download.intel.com/products/processor/manual/325462.pdf|dead-url=no}}</ref>。AMD处理器也可以使用同样的方式检测是否支持<ref>{{cite web|title=AMD64 Architecture Programmer’s Manual Volume 3: General-Purpose and System Instructions|url=http://support.amd.com/TechDocs/24594.pdf|publisher=AMD|accessdate=15 October 2015|page=278|date=June 2015|quote=Support for the RDRAND instruction is optional. On processors that support the instruction, CPUID Fn0000_0001_ECX[RDRAND] = 1|archive-date=2017-12-22|archive-url=https://web.archive.org/web/20171222094421/https://support.amd.com/TechDocs/24594.pdf|dead-url=no}}</ref>。在Intel CPU上，也可以使用类似的方法检测<code>RDSEED</code>是否支持。如果支持<code>RDSEED</code>，在调用完CPUID的标准函数<code>07H</code>后，EBX寄存器的第18位会被设置为1<ref>{{cite web|title=Volume 1, Section 7.3.17, 'Random Number Generator Instruction'|url=http://www-ssl.intel.com/content/dam/www/public/us/en/documents/manuals/64-ia-32-architectures-software-developer-manual-325462.pdf|work=Intel® 64 and IA-32 Architectures Software Developer’s Manual Combined Volumes: 1, 2A, 2B, 2C, 3A, 3B and 3C|publisher=Intel Corporation|accessdate=25 October 2015|authorlink=Intel Corporation|page=177|date=June 2013|quote=All Intel processors that support the RDSEED instruction indicate the availability of the RDSEED instruction via reporting CPUID.(EAX=07H, ECX=0H):EBX.RDSEED[bit 18] = 1|archive-date=2016-08-10|archive-url=https://web.archive.org/web/20160810060828/https://www-ssl.intel.com/content/dam/www/public/us/en/documents/manuals/64-ia-32-architectures-software-developer-manual-325462.pdf|dead-url=no}}</ref>。

<code>RDRAND</code>的操作码是<code>0x0F 0xC7</code>，后面跟一个ModRM字节，来指示目标寄存器。在64位模式下，还可以于REX前缀结合（这是可选的）<ref>{{cite web |url=http://software.intel.com/en-us/articles/intel-digital-random-number-generator-drng-software-implementation-guide |title=Intel® Digital Random Number Generator (DRNG) Software Implementation Guide | Intel® Developer Zone |publisher=Software.intel.com |date= |accessdate=2014-01-30 |archive-date=2014-01-12 |archive-url=https://web.archive.org/web/20140112161155/http://software.intel.com/en-us/articles/intel-digital-random-number-generator-drng-software-implementation-guide/ |dead-url=no }}</ref>。

''Intel安全密钥''是[[Intel]]为<code>RDRAND</code>指令和底层的[[随机数生成器]]（RNG）的硬件实现的统称，它在开发期间的代号是"Bull Mountain"<ref name="ieee2011" />。Intel称自己的RNG"数字随机数生成器"或DRNG。生成器采用有硬件产生的256位原始熵样本对，并将其应用到一个[[高级加密标准]]（AES）（在[[CBC-MAC]]模式下）调节器，将其减少到256位条件熵样本。

[[NIST SP 800-90A]]中定义了一个名叫CTR_DRBG的确定性随机数生成器。它由调节器的输出来初始化，为使用<code>RDRAND</code>指令的应用程序提供了密码学安全的随机数。<ref name="SIG" /><ref name="ieee2011">{{cite journal |first1=Greg |last1=Taylor |first2=George |last2=Cox |url=http://spectrum.ieee.org/computing/hardware/behind-intels-new-randomnumber-generator/0 |title=Behind Intel's New Random-Number Generator |journal=[[IEEE Spectrum]] |date=September 2011 |author= |access-date=2017-10-02 |archive-url=https://web.archive.org/web/20190701135731/https://spectrum.ieee.org/computing/hardware/behind-intels-new-randomnumber-generator/0 |archive-date=2019-07-01 |dead-url=yes }}</ref> 在重新初始化之前，硬件将发出最多511个128位的样本。使用<code>RDSEED</code>可以访问来自AES-CBC-MAC的、条件化后的256位样本。

为了初始化另一个为随机数生成器，<code>RDSEED</code>指令被添加到了Intel安全密钥<ref>{{cite web
|title=The Difference Between RDRAND and RDSEED
|url=http://software.intel.com/en-us/blogs/2012/11/17/the-difference-between-rdrand-and-rdseed
|work=software.intel.com
|publisher=Intel Corporation
|accessdate=1 January 2014
|author=John Mechalas
|date=November 2012
|archive-date=2017-10-02
|archive-url=https://web.archive.org/web/20171002215336/https://software.intel.com/en-us/blogs/2012/11/17/the-difference-between-rdrand-and-rdseed
|dead-url=no
}}</ref>，在[[Broadwell微架構]]的CPU上开始支持。<code>RDSEED</code>指令的熵来源自时序线路，并且使用硅片上的[[热噪声]]来以3GHz的速度输出随机比特流<ref>{{cite web
|last1=Mechalas
|first1=John
|title=Intel Digital Random Number Generator (DRNG) Software Implementation Guide, Section 3.2.1 Entropy Source (ES)
|url=https://software.intel.com/en-us/articles/intel-digital-random-number-generator-drng-software-implementation-guide
|website=https://software.intel.com
|publisher=Intel
|accessdate=18 February 2015
|archive-date=2017-10-02
|archive-url=https://web.archive.org/web/20171002115911/https://software.intel.com/en-us/articles/intel-digital-random-number-generator-drng-software-implementation-guide
|dead-url=no
}}</ref>。这比从<code>RDRAND</code>获得的6.4Gbit/s速率要慢（这两个速率都是所有[[多核心处理器|核心]]、所有[[线程]]共享）<ref>https://software.intel.com/en-us/articles/intel-digital-random-number-generator-drng-software-implementation-guide {{Wayback|url=https://software.intel.com/en-us/articles/intel-digital-random-number-generator-drng-software-implementation-guide |date=20171002115911 }} 说是 800 megabyte，即 6.4 gigabit每秒</ref>。<code>RDSEED</code>用来初始化任意宽度的软件 PRNG，而<code>RDRAND</code>指令适用于需要高质量随机数的应用程序。如果不要求密码学安全，软件随机数生成器比如[[Xorshift]]一般会比较快。<ref>最简单的64位[[Xorshift]]实现具有三次[[逻辑异或|异或]]和三次[[逻辑移位]]；如果这在4核2GHz CPU上运行，吞吐量是80 Gb/s。在实践中，由于存储、加载等开销，吞吐量会减少，但仍然会超过<code>RDRAND</code>的6.4 Gb/s。另一方面，<code>RDRAND</code>产生的随机数质量会比软件随机数生成器高，比如Xorshift。</ref>

===性能===
在Intel 酷睿 i7-7700K，4500MHz（45 x 100MHz）的处理器（[[Kaby Lake微架构|Kaby Lake-S]]架构）上，单个<code>RDRAND</code>或<code>RDSEED</code>指令花费110纳秒或463个时钟周期，不论操作数大小（16位、32位、64位）。这个时钟周期数适用于所有[[Skylake微架构|Skylake]]和[[Kaby Lake微架构|Kaby Lake]]架构的处理器。在[[Silvermont]]架构的处理器上，每个指令花费1472时钟周期，不论操作数大小；在[[Ivy Bridge微架构|Ivy Bridge]]架构的处理器上，花费117时钟周期<ref>{{Cite web |url=http://www.agner.org/optimize/instruction_tables.pdf |title=存档副本 |accessdate=2017-10-02 |archive-date=2014-07-30 |archive-url=https://web.archive.org/web/20140730030310/http://www.agner.org/optimize/instruction_tables.pdf |dead-url=yes }}</ref>。

在AMD Ryzen 处理器上，对于16位或32位操作数，每个指令约花费1200个时钟周期；对于64位操作数，约花费2500个时钟周期。

===编译器支持===
[[GCC]] 4.6+和[[Clang]] 3.2+提供了RdRand的{{le|intrinsic function||内置支持}}——当在[[CFLAGS|编译参数]]中指定了<code>-mrdrnd</code>命令行参数、并且在{{le|conditional compilation||条件编译}}时设置<code>__RDRND__</code>巨集的情况下<ref>{{Cite web |url=https://gcc.gnu.org/onlinedocs/gcc-4.8.5/gcc/X86-Built-in-Functions.html |title=存档副本 |accessdate=2017-10-02 |archive-date=2018-05-20 |archive-url=https://web.archive.org/web/20180520185844/https://gcc.gnu.org/onlinedocs/gcc-4.8.5/gcc/X86-Built-in-Functions.html |dead-url=no }}</ref>。更新的版本额外提供了<code>immintrin.h</code>将这些内置函数封装成与英特尔C编译器版本12.1+兼容的功能中。这些函数将随机数据写入参数指定的位置，并在成功时返回1 <ref>{{Cite web |url=https://software.intel.com/en-us/node/523864 |title=存档副本 |accessdate=2017-10-02 |archive-date=2017-10-02 |archive-url=https://web.archive.org/web/20171002120222/https://software.intel.com/en-us/node/523864 |dead-url=no }}</ref>。

===用来检测RDRAND指令的x86汇编语言例子===
<syntaxhighlight lang="asm">

; 使用 NASM 语法

section .data
msg db "0x00000000",10

section .text
global _start
_start:
mov eax,1
cpuid
bt ecx,30
mov rdi,1 ; exit code: failure
jnc .exit

; 如果没有随机数可用，rdrand 设置 CF=0
; Intel 的文档建议循环重试10次
mov ecx,11
.loop1:
dec ecx
jecxz .exit ; exit code 已经设置了
rdrand eax
jnc .loop1

; 将数字转换成 ASCII 字符
mov rdi,msg+9
mov ecx,8
.loop2:
mov edx,eax
and edx,0Fh
; add 7 to nibbles of 0xA and above
; to align with ASCII code for 'A'
; ('A' - '0') - 10 = 7
mov r8d,7
xor r9d,r9d
cmp dl,9
cmova r9,r8
add edx,r9d
add [rdi],dl
shr eax,4
dec rdi
loop .loop2

mov rax,1 ; SYS_WRITE
mov rdi,1 ; stdout
mov rsi,msg
mov rdx,11
syscall

mov rdi,0 ; exit code: success
.exit:
mov rax,60 ; SYS_EXIT
syscall

</syntaxhighlight>

== Reception ==
在2013年9月，[[曹子德|曹子德（Theodore Ts'o）]]为回应''[[纽约时报]]''的文章{{tsl|en|Global surveillance disclosures (2013–present)|}}，公开发文表达对[[Linux内核]]的<tt>[[/dev/random]]</tt>中使用<tt>RdRand</tt>的担忧<ref>{{cite web
|url=https://plus.google.com/117091380454742934025/posts/SDcoemc9V3J
|title=I am so glad I resisted pressure from Intel engineers to let /dev/random rely...
|date=September 6, 2013
|last=Ts'o
|first=Theodore
|accessdate=2017-10-02
|archive-date=2018-06-11
|archive-url=https://web.archive.org/web/20180611180213/https://plus.google.com/117091380454742934025/posts/SDcoemc9V3J
|dead-url=no
}}</ref>：

{{Quote|I am so glad I resisted pressure from Intel engineers to let /dev/random rely only on the RDRAND instruction. To quote from the article below: 'By this year, the [[Sigint Enabling Project]] had found ways inside some of the encryption chips that scramble information for businesses and governments, either by working with chipmakers to insert back doors....' Relying solely on the hardware random number generator which is using an implementation sealed inside a chip which is impossible to audit is a BAD idea.}}

[[林纳斯·托瓦兹]]驳斥了在Linux内核中使用<tt>RdRand</tt>的担忧，并指出<tt>RdRand</tt>不是<tt>/dev/random</tt>的唯一熵来源；从<tt>RdRand</tt>接受数据并和其他随机数来源结合来改善熵。<ref name="TheRegister" /><ref>{{cite web
|url=https://www.theregister.co.uk/2013/09/10/torvalds_on_rrrand_nsa_gchq/
|title=Torvalds shoots down call to yank 'backdoored' Intel RdRand in Linux crypto
|date=10 September 2013
|accessdate=12 March 2014
|author=Gavin Clarke
|publisher=theregister.co.uk
|archive-date=2019-11-09
|archive-url=https://web.archive.org/web/20191109073339/https://www.theregister.co.uk/2013/09/10/torvalds_on_rrrand_nsa_gchq/
|dead-url=no
}}</ref> 然而，Defuse Security的Taylor Hornby表明，如果将后门引入到专门针对使用代码的RdRand指令中，Linux随机数生成器可能会变得不安全。泰勒的概念验证实现在版本3.13之前的未修改的Linux内核上工作。<ref>{{cite web
|url=https://twitter.com/defusesec/status/408975222163795969
|title=RDRAND backdoor proof of concept is working! Stock kernel (3.8.13), only the RDRAND instruction is modified.
|date=6 December 2013
|accessdate=9 April 2015
|author=Taylor Hornby
|archive-date=2016-03-05
|archive-url=https://web.archive.org/web/20160305140453/https://twitter.com/defusesec/status/408975222163795969
|dead-url=no
}}</ref><ref>
{{cite tweet
|user=DefuseSec
|number=377609001258598400
|date=10 September 2013
|author=Taylor Hornby
|title=<nowiki>I wrote a short dialogue explaining why Linux's use of RDRAND is problematic. http://pastebin.com/A07q3nL3 /cc @kaepora @voodooKobra</nowiki>
|accessdate=11 January 2016
}}</ref><ref>{{cite web
|url=http://cr.yp.to/talks/2014.05.16/slides-dan+tanja-20140516-4x3.pdf
|title=Randomness generation
|date=16 May 2014
|accessdate=9 April 2015
|author1=Daniel J. Bernstein
|author2=Tanja Lange
|archive-date=2017-08-25
|archive-url=https://web.archive.org/web/20170825174629/https://cr.yp.to/talks/2014.05.16/slides-dan+tanja-20140516-4x3.pdf
|dead-url=no
}}</ref>

开发者注释掉了[[FreeBSD]]内核中直接使用<tt>RdRand</tt>和[[威盛電子]]的代码，并添加说明"对于 [[FreeBSD]] 10，我们将回溯并删除RDRAND和Padlock后端，并将它们提供给Yarrow，而不是将其输出直接传递到 /dev/random 。如果需要，还可以通过内联汇编或使用OpenSSL直接访问硬件随机数生成器，即RDRAND，Padlock等，但是我们不能再信任他们。"<ref name="TheRegister">{{cite news | title=FreeBSD abandoning hardware randomness | author=Richard Chirgwin | date=2013-12-09 | url=https://www.theregister.co.uk/2013/12/09/freebsd_abandoning_hardware_randomness/ | work=The Register | accessdate=2017-10-02 | archive-date=2017-10-02 | archive-url=https://web.archive.org/web/20171002120240/https://www.theregister.co.uk/2013/12/09/freebsd_abandoning_hardware_randomness/ | dead-url=no }}</ref><ref>{{cite web |url=http://www.freebsd.org/news/status/report-2013-09-devsummit.html#Security |title=FreeBSD Quarterly Status Report |publisher=Freebsd.org |date= |accessdate=2014-01-30 |archive-date=2014-01-22 |archive-url=https://web.archive.org/web/20140122211849/http://www.freebsd.org/news/status/report-2013-09-devsummit.html#Security |dead-url=no }}</ref>

== 参见 ==
{{Portal|计算机安全}}
* [[AES指令集]]
* [[Bullrun (NSA計畫)]]
* [[OpenSSL]]
* [[wolfSSL]]

== 注脚 ==
{{Notelist}}

== 参考资料 ==
{{Reflist|30em}}
[[Category:机器码]]
[[Category:X86微处理器]]
[[Category:X86指令]]
[[Category:随机数生成]]

RdRand - 版本历史

imported>Hehua：​加入{{Rough translation}}标记

imported>Hehua：加入{{Rough translation}}标记