Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 5 additions & 5 deletions config.toml
Original file line number Diff line number Diff line change
Expand Up @@ -18,11 +18,11 @@ publishDir = "docs"
identifier = "ws"
url = "https://www.qrypt.com/"
weight = 1
[[menu.shortcuts]]
name = '<div class=link-container><svg height=16px width=16px xmlns="http://www.w3.org/2000/svg" viewBox="0 0 390.01 388.4"><path d="m257.37 241.66 122.43 122.43-23.22 23.26-125.39-125.44 18.59 71.67-31.82 8.25-16.67-64.16-29.63 110.73-31.73-8.51 30.77-114.96-111.04 111.03-23.26-23.22 109.59-109.59-97.06 24.96-8.16-31.86 100.16-25.75-140.93-37.75 8.51-31.73 139.01 37.23-45.96-45.96 23.22-23.22 44.26 44.25-37.67-145.07 31.82-8.25 38.62 148.74 25.1-93.79 31.77 8.51-24.52 91.52 111.59-111.6 23.23 23.27-114.7 114.69 127.53-32.77 8.2 31.81-119.63 30.77 85.76 22.96-8.51 31.73z" fill="currentColor" style="fill: currentColor;"/></svg>&nbspQrypt Portal </div>'
identifier = "ps"
url = "https://portal.qrypt.com/"
weight = 2
# [[menu.shortcuts]]
# name = '<div class=link-container><svg height=16px width=16px xmlns="http://www.w3.org/2000/svg" viewBox="0 0 390.01 388.4"><path d="m257.37 241.66 122.43 122.43-23.22 23.26-125.39-125.44 18.59 71.67-31.82 8.25-16.67-64.16-29.63 110.73-31.73-8.51 30.77-114.96-111.04 111.03-23.26-23.22 109.59-109.59-97.06 24.96-8.16-31.86 100.16-25.75-140.93-37.75 8.51-31.73 139.01 37.23-45.96-45.96 23.22-23.22 44.26 44.25-37.67-145.07 31.82-8.25 38.62 148.74 25.1-93.79 31.77 8.51-24.52 91.52 111.59-111.6 23.23 23.27-114.7 114.69 127.53-32.77 8.2 31.81-119.63 30.77 85.76 22.96-8.51 31.73z" fill="currentColor" style="fill: currentColor;"/></svg>&nbspQrypt Portal </div>'
# identifier = "ps"
# url = "https://portal.qrypt.com/"
# weight = 2
[[menu.shortcuts]]
name = "<i class='fab fa-github'></i> Github Repo"
identifier = "gh"
Expand Down
12 changes: 0 additions & 12 deletions content/_index.md
Original file line number Diff line number Diff line change
Expand Up @@ -19,22 +19,10 @@ Below is a list of the products that Qrypt offers with links to their supporting
### [Quantum Entropy Appliance (on-prem)](eaas/appliance/)
Qrypt's on-prem quantum entropy appliance is a server that is intentended for on-prem deployments. It exposes a REST API that clients can call to retrieve quantum entropy from the QRNG card installed on the server.

### [Quantum Readiness](quantumreadiness/)

Quantum readiness provides centralized deployment and management UI of all Qrypt products.

### [Post quantum TLS proxy](postquantumproxy/)

This post quantum TLS proxy allows for incoming TLS connections to use post quantum cryptography.

### [Quantum Entropy as a Service](/eaas/)

Qrypt's Quantum Entropy service measures quantum effects and converts those measurements into pure random numbers. The service leverages multiple Quantum Random Number Generators (QRNGs) developed in collaboration with national and international research labs to ensure the highest quality random.

### [Key Generation](sdk/)

Qrypt SDK includes client library SDKs, cloud-based REST services, command line clients and guidance to help integrate post-quantum security into your applications and services. You can add security features to your applications without being an expert in post-quantum cryptography.

### [Portable OpenSSH with Qrypt](openssh/)

This implementation of OpenSSH has been modified to provide additional security via the Qrypt Key Generation SDK. During key exchange negotiation, the Qrypt SDK will generate an additional quantum-secure secret that is added to the session key hash inputs.
9 changes: 5 additions & 4 deletions content/eaas/_index.md
Original file line number Diff line number Diff line change
Expand Up @@ -8,11 +8,12 @@ disableToc = "true"

## Using Qrypt's Quantum Entropy Service

Qrypt’s Entropy as a Service is a RESTful web service that allows you to generate random data (henceforth referred to as entropy or random) that is truly random—based on quantum-mechanical phenomena.
Qrypt’s Entropy as a Service is a RESTful web service that allows you to generate random data (henceforth referred to as entropy or random) that is truly random—based on quantum-mechanical phenomena.

This service requires an access token. Follow the steps in [Getting Started]({{< ref "/getting_started" >}}) to obtain an access token.
This service requires an access token. Please {{< externalLink link="https://www.qrypt.com/contact/" text="contact us" >}} to obtain one.

### Related Tools and Services

1. [RNG Tools]({{< ref "/eaas/rngd" >}}): Integrating Qrypt's Quantum Entropy service as a random source for system devices.
2. [Qseed]({{< ref "/eaas/pkcs11" >}}): Integrating Qrypt's Quantum Entropy service as a random source for PKCS#11 HSMs.

Expand All @@ -31,7 +32,7 @@ Follow these steps in your preferred tool or language of choice to request entro
1. Specify your access token and the desired number of kibibytes (1,024 bytes) of entropy in a web request. Use the following URL: {{< externalLink link="https://api-eus.qrypt.com/api/v1/quantum-entropy?size={kib_entropy}" text="https://api-eus.qrypt.com/api/v1/quantum-entropy?size={kib_entropy}" >}}.
2. Replace {**kib_entropy**} in the aforementioned URL with an integer indicating the number of kibibytes of entropy to return.
3. Include an HTTP **“Accept”** header field with a value of **“application/json”**</span>.
4. Include an HTTP **“Authorization”** header with a value of **“Bearer {access_token}”**, where {**access_token**} is the access token obtained from the Qrypt portal.
4. Include an HTTP **“Authorization”** header with a value of **“Bearer {access_token}”**, where {**access_token**} is the access token obtained from the Qrypt portal (contact us to get one).
5. Submit the HTTP request using the HTTP GET method.
6. If the HTTP request is successful, the JSON-formatted response will contain a structure containing two fields named **“random”** and **“size”**. The **“random”** field contains an array of base64-encoded strings (each of which—when decoded—contains 1,024 bytes of entropy). The **“size”** field contains the number of elements in the **“random”** field.

Expand Down Expand Up @@ -76,7 +77,7 @@ The following illustrates an example of JSON output as returned by a request for
## Examples

The following examples demonstrate how to submit a request and display the returned entropy.
In the following examples, _{subdomain}_ should be replaced with the subdomain for a server in the geographic location you would like to use (see Table 2), _{kib_entropy}_ should be replaced with an integer between 1 and 512, and _{qrypt_access_token}_ should be replaced with an access token generated using your Qrypt account.
In the following examples, _{subdomain}_ should be replaced with the subdomain for a server in the geographic location you would like to use (see Table 2), _{kib_entropy}_ should be replaced with an integer between 1 and 512, and _{qrypt_access_token}_ should be replaced with an access token.

## Curl

Expand Down
25 changes: 18 additions & 7 deletions content/eaas/nist/_index.md
Original file line number Diff line number Diff line change
Expand Up @@ -5,13 +5,14 @@ weight = 20
chapter = false
+++


## Using Qrypt's NIST Entropy Quality Tests

Qrypt’s NIST Entropy Quality Tests is a set of APIs that allows you to check the quality of Qrypt's entropy using the NIST Statistical Test Suite. Tests are conducted every 10 minutes against Qrypt's Quantum Entropy service. Accessing this service does not require a Qrypt account or access token.
Qrypt’s NIST Entropy Quality Tests is a set of APIs that allows you to check the quality of Qrypt's entropy using the NIST Statistical Test Suite. Tests are conducted every 10 minutes against Qrypt's Quantum Entropy service. Accessing this service does not require a Qrypt access token.

---

## About NIST Entropy Quality Tests

The NIST Entropy Quality Test suite uses the 15 statistical tests defined by the NIST Statistical Test Suite (STS). Each of these 15 tests is repeated over many samples. The APIs generate two test results:

1. **Total number of individual passing tests**: considered successful if a sufficient number of individual tests pass. The threshold varies based on the number of individual tests run and is based on an alpha value of 0.01. For example, 1000 individual tests requires a 98% pass rate to be considered successful.
Expand All @@ -20,27 +21,32 @@ The NIST Entropy Quality Test suite uses the 15 statistical tests defined by the
The tests are considered as succeeding overall if either of these criteria are met. This provides a metric for passing that is more robust to fluctuations than using either criterion alone. However, this standard does not catch certain randomness defects. For example, if the randomness was periodic with a period equal to the size used for batching, a sufficiently high portion of the tests might pass, but the P-values would not be uniform.

## NIST Entropy Quality Test Endpoints
There are three endpoints for obtaining NIST entropy quality test results.

There are three endpoints for obtaining NIST entropy quality test results.

1. NIST Logs: retrieves a specified number of recent test results
2. Failing NIST Logs: retrieves a specified number of recent failing test results
3. Failing NIST Random: retrieves random of recent failing tests

### NIST Logs

This API contains the most recent NIST test results. To get NIST test results, you must submit an HTTP request to the API, optionally providing the number of results to view and whether they should be shown in a simplified format.

1. Make a request to the following URL: {{< externalLink link="https://nist.qrypt.com/api/v1/logs?num={num}&simple={simple}" text="https://nist.qrypt.com/api/v1/logs?num={num}&simple={simple}" >}}.
2. Optionally replace {**num**} with the desired number of recent test results to show.
3. Optionally replace {**simple**} with a true or false to specify if you want a simplified test result output.

##### Request Parameters

{{< nist/logs/requestParameters >}}

##### Response Codes

{{< nist/logs/responseCodes >}}

##### JSON Response Fields

For a successful 200 response, the response contains a JSON-encoded structure with an array of test results with the following fields in each array element. Note that the simplified logs only contain 'tests_passed', 'time_of_completion' and 'time_of_completion_string' fields.
For a successful 200 response, the response contains a JSON-encoded structure with an array of test results with the following fields in each array element. Note that the simplified logs only contain 'tests_passed', 'time_of_completion' and 'time_of_completion_string' fields.

There are two main groupings of tests. One is prefixed 'nist' for the number of NIST STS tests that passed or failed, and the second is 'uniformity' for the uniformity of each NIST STS test's P-values.

Expand All @@ -67,19 +73,22 @@ The following illustrates an example of JSON output as returned by a request for
```

### NIST Failed Test Logs

This API contains the most recent failed NIST test results, where both the individual test rate and uniformity tests fail. To get failed NIST test results, you must submit an HTTP request to the API.

1. Make a request to the following URL: {{< externalLink link="https://nist.qrypt.com/api/v1/failing_logs?num={num}&simple={simple}&strict={strict}&include_random={include_random}&randsize={randsize}" text="https://nist.qrypt.com/api/v1/failing_logs?num={num}&simple={simple}&strict={strict}&include_random={include_random}&randsize={randsize}" >}}
2. Optionally replace {**num**} with the number of recent test results to show.
3. Optionally replace {**simple**} with 'true' to output simplified logs.
4. Optionally replace {**strict**} with 'false' specify if you want to show logs that failed either the test rate or uniformity.
4. Optionally replace {**include_random**} with 'true' to see failed random. Only applicable if 'strict' is 'true'.
5. Optionally replace {**randsize**} with the number of bits to show. Only applicable if 'include_random' is set to 'true'.
5. Optionally replace {**include_random**} with 'true' to see failed random. Only applicable if 'strict' is 'true'.
6. Optionally replace {**randsize**} with the number of bits to show. Only applicable if 'include_random' is set to 'true'.

##### Request Parameters

{{< nist/failing_logs/requestParameters >}}

##### Response Codes

{{< nist/failing_logs/responseCodes >}}

##### JSON Response Fields
Expand Down Expand Up @@ -109,18 +118,20 @@ The following illustrates an example of JSON output as returned by a request for
]
```


### NIST Failed Random

This API contains the random of the most recent strictly failing NIST tests. To get the random of failed NIST test results, you must submit an HTTP request to the API.

1. Make a request to the following URL: {{< externalLink link="https://nist.qrypt.com/api/v1/failing_random?num={num}&randsize={randsize}" text="https://nist.qrypt.com/api/v1/failing_random?num={num}&randsize={randsize}" >}}
2. Optionally replace {**num**} with the number of recent test results to show.
3. Optionally replace {**randsize**} with 'true' to output simplified logs.

##### Request Parameters

{{< nist/failing_random/requestParameters >}}

##### Response Codes

{{< nist/failing_random/responseCodes >}}

##### JSON Response Fields
Expand Down
6 changes: 4 additions & 2 deletions content/eaas/pkcs11/_index.md
Original file line number Diff line number Diff line change
Expand Up @@ -5,15 +5,18 @@ weight = 40

This page covers the [Qseed](https://github.com/QryptInc/qseed) application architecture that downloads quantum entropy from Qrypt's entropy service and injects it into a PKCS#11 compliant HSM (Hardware Security Modules) as seed random.

This service requires an access token. Follow the steps in [Getting Started]({{< ref "/getting_started" >}}) to obtain an access token.
This service requires an access token. Please {{< externalLink link="https://www.qrypt.com/contact/" text="contact us" >}} to obtain one.

## Technology Value

Many of the available HSMs use non-quantum entropy sources. Fortunately, the PKCS#11 Cryptoki interface provides a C_SeedRandom function to inject entropy into a PKCS#11 compliant HSM. Developers can inject Qrypt's quantum entropy into a HSM using the C_SeedRandom function. As a result, HSM keys can be pseudorandomly generated from quantum entropy.

## Overview

{{< figure src="images/inject-seedrandom.png" >}}

There are four components to the architecture diagram above.

1. **Qrypt Services**: Qrypt's entropy service that can provide quantum entropy via a REST API.
2. **Qseed Application**: Application that periodically retrieves entropy from Qrypt's entropy service and injects it into an HSM via a PKCS#11 Cryptoki interface (C_SeedRandom).
3. **Cryptoki Library**: A library that the HSM vendor provides that implements the PKCS#11 Cryptoki interface for their device.
Expand Down Expand Up @@ -44,4 +47,3 @@ The Qseed application only support Crypto User PINs. You will need to create a C
## References

More information about the PKCS#11 Cryptoki interface can be found at [Oasis PKCS#11 Specification](https://docs.oasis-open.org/pkcs11/pkcs11-base/v2.40/os/pkcs11-base-v2.40-os.html).

24 changes: 17 additions & 7 deletions content/eaas/rngd/_index.md
Original file line number Diff line number Diff line change
Expand Up @@ -8,24 +8,26 @@ disableToc = "true"

## Using Qrypt's Quantum Entropy in RNG Tools

*rng-tools* is a utility that allows you to inject entropy from hardware sources, prngs, and http streams into system devices. Qrypt's Quantum Entropy service is a random source option in *rng-tools*, allowing you to inject quantum entropy into system devices such as '/dev/random', '/dev/urandom', and user-defined nodes or files.
_rng-tools_ is a utility that allows you to inject entropy from hardware sources, prngs, and http streams into system devices. Qrypt's Quantum Entropy service is a random source option in _rng-tools_, allowing you to inject quantum entropy into system devices such as '/dev/random', '/dev/urandom', and user-defined nodes or files.

This service requires an access token. Follow the steps in [Getting Started]({{< ref "/getting_started" >}}) to obtain an access token.
This service requires an access token. Please {{< externalLink link="https://www.qrypt.com/contact/" text="contact us" >}} to obtain one.

More information about *rng-tools* can be found on the {{< externalLink link="https://github.com/nhorman/rng-tools" text="rng-tools Github" >}} and the {{< externalLink link="https://wiki.archlinux.org/title/Rng-tools" text="rng-tools wiki page" >}}.
More information about _rng-tools_ can be found on the {{< externalLink link="https://github.com/nhorman/rng-tools" text="rng-tools Github" >}} and the {{< externalLink link="https://wiki.archlinux.org/title/Rng-tools" text="rng-tools wiki page" >}}.

---

## Installation

To use Qrypt's Quantum Entropy service in *rng-tools*, *rng-tools* must be installed and configured.
To use Qrypt's Quantum Entropy service in _rng-tools_, _rng-tools_ must be installed and configured.

Clone the latest _rng-tools_ master from GitHub.

Clone the latest *rng-tools* master from GitHub.
```bash
git clone https://github.com/nhorman/rng-tools
```

Install *rng-tools* dependencies. Additional packages may be required, depending on linux distro. The configure script below will name any missing packages it encounters.
Install _rng-tools_ dependencies. Additional packages may be required, depending on linux distro. The configure script below will name any missing packages it encounters.

```bash
sudo apt install \
make \
Expand All @@ -41,6 +43,7 @@ sudo apt install \
```

Add `--disable-dependency-tracking` to the './configure' command if needed.

```bash
./autogen.sh
./configure
Expand All @@ -49,11 +52,13 @@ sudo make install
```

Verify installation.

```bash
which rngd
```

## Command Line Usage

The resulting 'rngd' executable can run directly to start either a daemon or a foreground process. By default, 'rngd' will run as a background daemon and attempt to use the 'hwrng', 'errand', 'pkcs11', and 'rtlsdr' random sources.

To run 'rngd' using exclusively Qrypt's Quantum Entropy, run the following command. This will run 'rngd' as a foreground process with the Qrypt source enabled and all other entropy sources disabled. 'rngd' will send its random to the /dev/random device.
Expand All @@ -68,7 +73,8 @@ Command line options:
{{< rngd/rngd-options >}}

## Service Usage
*rng-tools* comes with a 'rngd.service' file for setting up a systemd service. To configure rngd to automatically start the Qrypt source on boot, follow these steps:

_rng-tools_ comes with a 'rngd.service' file for setting up a systemd service. To configure rngd to automatically start the Qrypt source on boot, follow these steps:

Save your Qrypt api token to a system-accessible directory, such as '/etc/rngd/qrypt.token'. Then, edit 'rngd.service' to add Qrypt arguments and options.

Expand All @@ -90,23 +96,27 @@ WantedBy=multi-user.target
```

Copy the 'rngd' service to systemd.

```
sudo cp rngd.service /etc/systemd/system/rngd.service
sudo chmod 644 /etc/systemd/system/rngd.service
```

Start the 'rngd' service.

```
sudo systemctl daemon-reload
sudo systemctl start rngd
```

Verify the 'rngd' service is running properly.

```
sudo systemctl status rngd
```

Enable the 'rngd' service for it to start on system boot.

```
sudo systemctl enable rngd
```
Loading