Re: RFC: adding "jitterentropy" library to base

I stand corrected with a single important point...

> On Apr 23, 2026, at 12:17 PM, Enji Cooper (yaneurabeya) <[email protected]> wrote:
> 
> (cem@ and secteam@ BCCed so they can weigh in on this if they like)
> Hi,
> 	A key component for FreeBSD becoming NIST FIPS 140-3 compliant was completed when FreeBSD upgraded from OpenSSL 3.0 to 3.5. One of the other requirements for FIPS 140-3 (and post-quantum cryptography) is having sufficient random entropy in the system to generate sufficiently random numbers. NIST SP800-90B provides some guidelines on how to achieve that [1].
> 	One capability in the base system that provides such a guarantee is RDSEED [2], but that is CPU/hardware-specific and does not support all possible architectures today. Furthermore, there are discussions of challenges around certifying RDSEED in derivative distributions (including the commit where the support was introduced).
> 	The jitterentropy project provides an alternative mechanism for this in userspace that is less CPU/hardware-specific [3] [4]..
> 	This component already exists in ports [4], but in order to ensure that the base system version of OpenSSL can capitalize on it, it needs to be integrated into base and built alongside libcrypto.
> 	My proposal for how to achieve this is included below, along with some deliverables, rough implementation-specific details, and rough timelines.
> 	Does anyone have any thoughts on the proposed plan sketched out below?
> Thank you,
> -Enji
> 
> PS I CCed the ports maintainer (swills@), several folks from HPE/Juniper (since they provided the RDSEED implementation), secteam@, etc, to obtain feedback on this work.
> 
> # Objective 1: add jitterentropy-library to the base system
> 
> - Do a vendor import of the component.
> - Add to the base system:
> 	- Given that it’s a cryptographic-related component, crypto/jitterentropy seems like the most appropriate location for the library.
> 	- Conditionally enable support in OpenSSL and building the library using the `MK_OPENSSL_JITTERENTROPY` build knob.
> 	- Add packaging metadata so the component is properly released using `pkgbase`.
> 	- Integrate any additional programs into the base system which provide health check capabilities described in NIST SP800-90B [1].
> 
> ## Timeline
> 
> The goal is to do this start this work in the next week.
> 
> # Objective 2: add additional hardware support to the jitterentropy library.
> 
> The library supports the following FreeBSD-available architectures out of the box:

> - amd64/i386
> - PowerPC

aarch64 is supported in addition to amd64/i386/PowerPC (the check in the library is a bit naive today — it doesn’t confirm that the featureset is enabled — only that it’s being built on aarch64).

This means that all Tier-1 architectures are supported with this library.

Other architecture support is still outstanding.

Cheers,
-Enji