16 Configuration files and environment variables

This chapter describes which files and environment variables can be used to change the behaviour of Libgcrypt.

The environment variables considered by Libgcrypt are:

LIBGCRYPT_FORCE_FIPS_MODE

By setting this variable to any value, Libgcrypt is put into FIPS mode at initialization time (see enabling fips mode).

GCRYPT_BARRETT

By setting this variable to any value a different algorithm for modular reduction is used for ECC.

GCRYPT_RNDUNIX_DBG

GCRYPT_RNDUNIX_DBGALL

These two environment variables are used to enable debug output for the rndunix entropy gatherer, which is used on systems lacking a /dev/random device. The value of GCRYPT_RNDUNIX_DBG is a file name or - for stdout. Debug output is the written to this file. Setting GCRYPT_RNDUNIX_DBGALL to any value will make the debug output more verbose.

GCRYPT_RNDW32_NOPERF

Setting this environment variable on Windows to any value disables the use of performance data (HKEY_PERFORMANCE_DATA) as source for entropy. On some older Windows systems this could help to speed up the creation of random numbers but also decreases the amount of data used to init the random number generator.

GCRYPT_RNDW32_DBG

Setting the value of this variable to a positive integer logs information about the Windows entropy gatherer using the standard log interface.

HOME

This is used to locate the socket to connect to the EGD random daemon. The EGD can be used on system without a /dev/random to speed up the random number generator. It is not needed on the majority of today’s operating systems, and support for EGD requires the use of a configure option at build time.

The files which Libgcrypt uses to retrieve system information and the files which can be created by the user to modify Libgcrypt’s behavior are:

/etc/gcrypt/hwf.deny

This file can be used to disable the use of hardware based optimizations, see hardware features.

/etc/gcrypt/random.conf

This file can be used to globally change parameters of the random generator. The file is a simple text file where empty lines and lines with the first non white-space character being ’#’ are ignored. Supported options are

disable-jent

Disable the use of the jitter based entropy generator.

only-urandom

Always use the non-blocking /dev/urandom or the respective system call instead of the blocking /dev/random. If Libgcrypt is used early in the boot process of the system, this option should only be used if the system also supports the getrandom system call.

/etc/gcrypt/fips_enabled

/proc/sys/crypto/fips_enabled

On Linux these files are used to enable FIPS mode, see enabling fips mode.

/proc/cpuinfo

/proc/self/auxv

On Linux running on the ARM architecture, these files are used to read hardware capabilities of the CPU.