12

I'm trying to understand if the XNU underpinnings of macOS (BSD) still use the Yarrow cryptographically secure pseudorandom number generator?

I have looked through the source and it seems as if they switched to a DRBG NIST generator?

https://opensource.apple.com/source/xnu/xnu-4903.221.2/osfmk/corecrypto/ccdbrg/src/ccdrbg_nisthmac.c.auto.html

There are very few references to Yarrow in the 10.14 XNU code compared with older versions of the Kernel, but 10.14 still contains this string in key.c :

/* Our PRNG is based on Yarrow and doesn't need to be seeded */

That said if you looked at older XNU Yarrow is littered everywhere.

Source code for XNU:

Lots of Yarrow references in XNU 2782 - macOS 10.11

Very few Yarrow references in XNU 4903 - macOS 10.14

So, are Apple still using Yarrow?

I ask because Yarrow is only capable of generating 160bit strong keys.

2 Answers 2

6

Yarrow is gone.

The kernel CPRNG is a Fortuna-derived design targeting a 256-bit security level.

https://support.apple.com/en-ie/guide/security/seca0c73a75b/1/web/1

Ok! So I mailed Craig Federighi recently about this, concerned that macOS wasn’t capable of generating >128bit quality keys.

He responded!

‘The source you were referencing is out of date. You can find more current informations here: FIPS certification document, section 7: "The NDRNG feeds entropy from the pool into the DRBG on demand. The NDRNG provides 256-bits of entropy.”’

What a legend.

enter image description here

So yup, macOS and iOS are both capable of generating 256 bit entropy and creating quality CS keys for both ECC and Symmetric Key crypto.

EDIT: Apple confirmed the kernel CPRNG is a Fortuna-derived design targeting a 256-bit security level.

1
  • Thanks for looking into this. Would you happen to know which versions of macOS include Fortuna vs Yarrow?
    – sunknudsen
    Aug 25, 2021 at 11:56
1

It seems as of 10.14 Apple are still using Yarrow.

The source of xnu-4903.221.2/osfmk/prng/random.h says "...we retain Yarrow." and the subsequent code is conditioned on Yarrow being hard coded true:

void early_random_cpu_init(int cpu);

/*
 * Wrapper for requesting a CCKPRNG operation.
 * This macro makes the DRBG call with pre-emption disabled to ensure that
 * any attempt to block will cause a panic. And the operation is timed and
 * cannot exceed 10msec (for development kernels).
 * But skip this while we retain Yarrow.
 */
#define YARROW 1
#if YARROW
#define PRNG_CCKPRNG(op) \
    MACRO_BEGIN          \
    op;                  \
    MACRO_END
#else

Assuming it is up to date, man random on 10.14.5 confirms this:

 The random device implements the Yarrow pseudo random number generator algorithm and maintains
 its entropy pool.  The kernel automatically seeds the algorithm with additional entropy during
 normal execution.

Whether Yarrow is sufficient or not seems to be covered in your other question.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .