Sources of randomness

From Randomness for cryptography
Jump to navigation Jump to search

Potential sources of true randomness (entropy) include:

Physical sources

Thermal noise

Zener diode

Chaotic systems

Ring oscillators

Sensor noise

Radioactive decay

Single purpose hardware random number generators

Commercial RNG black boxes

Hardware security modules

  • Addresses side channel issues
  • Certification available
  • Compliance friendly, arguably best practice
  • More expensive and harder to audit

CPU instruction

Intel's x86 RdRand instruction extension

  • fast
  • published design looks good
  • available at programming level

RdRand controversial

  • No programming access to internal entropy source
  • Built-in whitener could be subverted
  • Dopant attack undetectable

No such instruction available on ARM platform as of March 2014

Entropy from devices with other purposes

Hard drive

System state

  • Uninitialized RAM at startup eg
  • operating system dependent
  • Fragile, technology updates can change things

Sound input

Video camera

  • even low end VGA cameras have 640X480 = 307,200 pixel sensors
  • multi-mega-pixel cameras common
  • Many sources of noise from image capture physics
  • built in compression removes some entropy, but not all
  • imaging active scenes add separate source of entropy
    • streamers in fan
    • aquarium bubbler, with or without fish
    • Lavarand patent
    • candy or dice dumped on a tray as example. What could machine vision recover from image?

Accelerometer

  • common to smart phones, tablets
  • inexpensive
  • digital I2C interface
  • analog to GPIO pin per axis
  • buzzer to stimulate static systems
  • remove low-pass filter capacitor?

Radio

  • WiFi, Bluetooth, cellular network
    • Do APIs reveal random data?

Euro TV USB dongles

  • USB dongles designed to receive European DVB-T (Digital Video Broadcasting — Terrestrial) broadcasts
  • Units that use the Realtek RTL2832U chip are inexpensive (~$20) and widely available
  • RTL2832U chip allows access to raw 8-bit samples at 2.5+ mega-samples/second
  • Extensive software available from software-defined radio (SDR) experimenters
  • low level drivers available for most platforms [1]
  • Up-converter board available with wide-band zener noise generator [2]
  • Receiver noise probably adequate for entropy harvesting

Network activity

  • Limited availability at startup
  • Can possibly be controlled remotely

Radiation detector

  • Geiger tube
  • Modified smoke alarm

User input

  • keyboard timing
  • mouse or other pointing device
  • accelerometer
  • asking user to input random data, e.g. dice throws, currency serial numbers
  • human choices too predictable, but precisely measured movements are not

Home brew

  • Maker movement
  • Arduino
  • Digispark, ATtiny85
  • less is more

Mechanical sources

Dice

  • cubic (d6)
  • other
  • effect of bias
  • Shaken vs stirred
  • possible camera subject

Playing cards

  • log2 (52!) = 225.581

Bad sources

Program library random function

  • often have small internal state (16, 32 or 48 bits)
  • often seeded by low entropy source such as system clock
  • poor quality PRNGs used, e.g. linear congruential
  • better algorithms such as Mersenne Twister still not recommended
  • Possible exceptions:
    • SystemRandom class and os.urandom() in Python
    • Intel's cryptgenrandom?,
    • Java SecureRandom??

On line services

  • Web traffic subject to interception
  • Securing connection requires prior source of randomness
  • may be useful for time stamp purposes, e.g. NIST beacon

White or pink noise generators

  • Sold for privacy purposes and for calibrating audio systems
  • Often shift register based, very small state
  • Zener based ok, if this can be determined reliably