16 Configuration files and evironment variables

This chapter describes which files and environment variables can be used to change the behaviour of Libgcrypt.

The environment variables considered by Libgcrypt are:

GCRYPT_BARRETT

By setting this variable to any value a different algorithm for modular reduction is used for ECC.

GCRYPT_RNDUNIX_DBG

GCRYPT_RNDUNIX_DBGALL

These two environment variables are used to enable debug output for the rndunix entropy gatherer, which is used on systems lacking a /dev/random device. The value of GCRYPT_RNDUNIX_DBG is a file name or - for stdout. Debug output is the written to this file. By setting GCRYPT_RNDUNIX_DBGALL to any value the debug output will be more verbose.

GCRYPT_RNDW32_NOPERF

Setting this environment variable on Windows to any value disables the use of performance data (HKEY_PERFORMANCE_DATA) as source for entropy. On some older Windows systems this could help to speed up the creation of random numbers but also decreases the amount of data used to init the random number generator.

HOME

This is used to locate the socket to connect to the EGD random daemon. The EGD can be used on system without a /dev/random to speed up the random number generator. It is not needed on the majority of today’s operating systems and support for EGD requires the use of a configure option at build time.

The files which Libgcrypt uses to retrieve system information and the files which can be created by the user to modify Libgcrypt’s behavior are:

/etc/gcrypt/hwf.deny

This file can be used to disable the use of hardware based optimizations, see hardware features.

/etc/gcrypt/fips_enabled

/proc/sys/crypto/fips_enabled

On Linux these files are used to enable FIPS mode, see enabling fips mode.

/proc/cpuinfo

/proc/self/auxv

On Linux running on the ARM architecture, these files are used to read hardware capabilities of the CPU.