### 2.7 How to disable hardware features

Libgcrypt makes use of certain hardware features. If the use of a feature is not desired it may be either be disabled by a program or globally using a configuration file. The currently supported features are

`padlock-rng`
`padlock-aes`
`padlock-sha`
`padlock-mmul`
`intel-cpu`
`intel-bmi2`
`intel-ssse3`
`intel-pclmul`
`intel-aesni`
`intel-rdrand`
`intel-avx`
`intel-avx2`
`arm-neon`

To disable a feature for all processes using Libgcrypt 1.6 or newer, create the file `/etc/gcrypt/hwf.deny` and put each feature not to be used on a single line. Empty lines, white space, and lines prefixed with a hash mark are ignored. The file should be world readable.

To disable a feature specifically for a program that program must tell it Libgcrypt before before calling `gcry_check_version`. Example:2

      gcry_control (GCRYCTL_DISABLE_HWF, "intel-rdrand", NULL);

To print the list of active features you may use this command:

      mpicalc --print-config | grep ^hwflist: | tr : '\n' | tail -n +2

#### Footnotes

### (2)

NB. Libgcrypt uses the RDRAND feature only as one source of entropy. A CPU with a broken RDRAND will thus not compromise of the random number generator