Is there a way to use ring with os=none, for random ?

[jyao1]

Currently, the biggest problem is rand implementation (https://github.com/briansmith/ring/blob/main/src/rand.rs). It seems using target_os check the OS environment and implement different random function.

We are going to use ring in os=none. Is there any suggestion on how to enable that ?
Also, we would like to contribute patch, if update is required.

[briansmith]

We are going to use ring in os=none. Is there any suggestion on how to enable that ?

What OS-less environment are you targeting? If it is SGX or UEFI then I'm somewhat familiar with them and I have thought about how to support them.

[jyao1]

Yes. UEFI is one use case. A bare metal Trust Domain (TD) in Intel TDX (https://software.intel.com/content/www/us/en/develop/articles/intel-trust-domain-extensions.html) is another use case. Similar to SGX.

We are doing some POC work and hope to upstream step by step.

• https://github.com/jyao1/ring/tree/uefi_support
• https://github.com/jyao1/webpki/tree/uefi_support

How to support Random is still an open. If you have any thought, please share with us.

[briansmith]

For the time being, we can add a less-safe-getrandom-rdrand feature that lets us use getrandom as it is for UEFI, as I suggest in my review of PR #1406. And the same for other targets where getrandom uses rdrand.

Going forward, I expect ring will provide a "userspace" CSPRNG for use within ring, including the public ring::rand API, specifically to support these targets so we don't have to read RDRAND directly. This is TBD. But the short-term solution outlined above is OK for 0.17.

[briansmith]

Closing as a duplicate of #744; I copied my comment above to that issue.