Bug 15 - Entropy Source: Markov Health Test Dead (>= Instead of >, Failure Pulse Hardwired to 0)
Legacy reference: Bug #22 in the working set
Security feature bypassed
Entropy source Markov health test - the statistical test that must detect entropy degradation
Attack type
Type 2 - physical attacker (passive environmental manipulation)
Finding
The Markov health-test high-threshold comparison is an off-by-one (>= instead of >) and
the failure pulse output is hardwired to 1'b0:
// entropy_src_markov_ht.sv - health test comparison
assign test_fail_hi_pulse_o = 1'b0; // never raised
// test_fail_hi = test_cnt_hi >= threshold; // BUG: >= instead of >
The threshold value itself can never trigger a failure, and even a genuine exceedance is swallowed by the dead output. The entropy source can degrade to threshold level (or beyond) without any health-test alert.
Location or code reference
- hw/ip/entropy_src/rtl/entropy_src_markov_ht.sv:158 -
assign test_fail_hi_pulse_o = 1'b0;- hi-side failure never raised - hw/ip/entropy_src/rtl/entropy_src_markov_ht.sv:159 -
assign test_fail_lo_pulse_o = 1'b0;- lo-side failure never raised
New Tools
Yes - actual-RTL module instantiation (Verilator 4.210):
entropy_src_markov_ht_tb.sv instantiates the real entropy_src_markov_ht.sv with its
genuine dependency chain, drives a clearly-failing entropy stream (60 consecutive
identical bits, exceeding thresh_hi=4), and observes test_fail_hi_pulse_o stays 0 -
the hi-side health test is dead (see testbench/logs/rtl-test-simulation.log).
AI Tools
No.
LLM
No.
LLM Details
PLACEHOLDER - to be completed (model name/version, parameters, download link or API endpoint).
Online LLM Details
PLACEHOLDER - to be completed (input/output/total token counts, verification script).
LLM Prompts
PLACEHOLDER - to be completed (complete prompt, full model response, step-by-step explanation).
Detection method
Actual-RTL instantiation (property: a failing entropy stream must raise
test_fail_hi_pulse_o) + RTL grep evidence (logs/rtl_evidence.log).
Security impact
The entropy source is the root of all randomness in the SoC. Degraded entropy (exactly at or above threshold) reaches CSRNG and Key Manager without alert; cryptographic keys become statistically biased - predictable. No fault injection needed - environmental manipulation (temperature, voltage droop) suffices.
Adversary profile
Type 2 - physical attacker manipulating operating conditions (extreme temperature, voltage droop) to degrade the entropy source. Passive attack; no fault injection.
Proposed mitigation
// Fix 1: strict comparison
assign test_fail_hi = test_cnt_hi > threshold;
// Fix 2: enable the failure pulse
assign test_fail_hi_pulse_o = test_fail_hi; // not 1'b0!
CVSSv3.1 score and severity
5.9 - MEDIUM
CVSSv3.1 Details
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
- AV: Physical - environmental manipulation
- AC: Low - passive conditions
- PR: None
- S: Changed - crosses from entropy source into all derived randomness
- C: High - predictable keys
Attachment links
Located in this repository (GitHub is the cloud storage for the submission):