Return to Revisions

No one knows, so we can't say. But it's not looking good.

Since the device is completely unverifiable, it could do anything. All we know for certain is that it is impossible to mathematically verify true randomness. Computational indistinguishably means that the output could simply be any decent $ \operatorname{E}_{k \; \oplus \; cpuid} (ctr) $ like CSPRNG. Intel state that it's AES-CBC-MAC throughout anyway.

Wikipedia is not the oracle of all truth, and really has to be ignored in this context. The primary verification of the device is ANALYSIS OF INTEL’S IVY BRIDGE DIGITAL RANDOM NUMBER GENERATOR. That was followed up with an academic report, A Provable-Security Analysis of Intel’s Secure Key RNG. Unfortunately for users, both reports are based on a raw entropy rate of ~0.5 bits/bit. And to be a gold standard TRNG, (entropy out) < (entropy in). But it says in those reports:-

"We did not have access to Ivy Bridge parts, so Intel provided us with testing data from pre-production chips. These chips allow access to the raw ES output, a capability which is disabled in production chips. "

The whole analysis is built on sand. Many factors create reasons for suspicion:-

1. It is not in the interest of the US government/NSA/security community to produce fast secure random number generators for public use.
2. The NSA has form on this, with many examples publically available.
3. All public analysis of the chip is based on unverified data samples supplied by Intel themselves. Is ~0.5 bits/bit real?
4. The primary analysis of RDSEED was paid for by Intel which is a huge conflict of interest, tantamount to marking your own homework. From that report's front page - "This report was prepared by Cryptography Research, Inc. (CRI) under contract to Intel Corporation".
5. The entropy source operates at a suspiciously high 3GHz. Academic laboratory TRNG's have only recently attained this rate using optical means. If true, I would expect huge correlation at this sample rate. Injecting 1% entropy into a CSPRNG stream does not make a TRNG.
6. The entropy source is an atypical circuit not replicated in the hacker community, and the only detailed analysis is by Intel themselves and unpublished. (C. E. Dike, "3 Gbps Binary RNG Entropy Source," Intel Corporation (unpublished), 2011.)
7. There is no raw entropy source available for inspection, and even if there was, the level of integration means that we can't verify that the source is actually used.
8. *nix developers do not trust it.

Therefore in secure environments, I have to say that it's too uncertain to be used as a true random number generator. The most of the *nix community agrees with me.