Re: [PATCH] KEYS: trusted: Use get_random-fallback for TPM

[James Bottomley <James.Bottomley@HansenPartnership.com>]

On Mon, 2025-12-15 at 21:43 +0200, Jarkko Sakkinen wrote:
[...]
> I think there is misunderstanding with FIPS.
> 
> Having FIPS certificated RNG in TPM matters but it only matters only
> in the sense that callers can be FIPS certified as they use that RNG
> as a source.
> 
> Using FIPS certified RNG does not magically make callers be FIPS 
> ceritified actors. The data is contaminated in that sense at the
> point when kernel acquires it.

I think FIPS certification is a red herring.  The point being made in
the original thread is about RNG quality.  The argument essentially
being that the quality of the TPM RNG is known at all points in time
but the quality of the kernel RNG (particularly at start of day when
the entropy pool is new) is less certain.

Regards,

James