Generation of Cryptographic Keys
When your application requests cryptographic keys with the
PUT /api/protected_items/:name?generate=XX call, the
Porticor appliance generates fresh random material. We do
not derive the key from any other key. Instead, we
use the OpenSSL random number generator as direct input for the
key. For additional information about OpenSSL randomness, see
OpenSSL in turn obtains randomness from the Linux /dev/urandom, which is widely used for cryptographic purposes. /dev/urandom collects physical randomness ("entropy") from a variety of sources and mixes them into a pseudo-random stream. A description of /dev/random and /dev/urandom is available here: http://tools.ietf.org/html/rfc4086#section-7.1.2. The description is somewhat old, but we believe it is still applicable.
Since virtual machines are notoriously poor in physical randomness, we specifically enhance the unpredictable randomness available to the appliance through the following process:
- On every boot of the appliance, we mix into /dev/urandom an additional 256 bytes (2048 bits) of randomness obtained from the Porticor Virtual Key Management (PVKM) service. In addition the appliance retains a seed file between reboots, so this is primarily essential for the first-time boot.
- When creating a new PVKM instance, we mix the same amount of entropy obtained from a desktop machine, which of course has access to a large amount of physical entropy.
For more information about our approach to randomness, see also our Knowledge Base article, https://porticor.com/kb/product-backgrounders/random-numbers-in-the....