CCF icon indicating copy to clipboard operation
CCF copied to clipboard

Use of `RDSEED`/`RDRAND` on AMD with OpenSSL 3.x

Open jumaffre opened this issue 2 years ago • 0 comments

AMD SEV-SNP builds are currently on Ubuntu 20.04 and so OpenSSL 1.1.x is used there. This lets us make use of OpenSSL's ENGINE_x API to use RDSEED/RDRAND. However, on SGX builds, RDSEED/RDRAND are implicitly used via Open Enclave's OpenSSL 3.x (see here).

When AMD builds are moved to OpenSSL 3.x (e.g. via the upgrade to Ubuntu 22.04), we should change the use of the ENGINE_x API which is deprecated on OpenSSL 3.x, and instead make us of the new provider API. As discussed with @achamayou, this is better than building OpenSSL 3.x with --with-rand-seed=rdcpu ourselves).

jumaffre avatar Aug 18 '23 16:08 jumaffre