Sources of randomness
Jump to navigation
Jump to search
Potential sources of true randomness (entropy) include:
Physical sources
Thermal noise
Zener diode
Chaotic systems
Ring oscillators
Sensor noise
Radioactive decay
Single purpose hardware random number generators
Commercial RNG black boxes
- Expensive
- require I/O port, risk of interception, side channel attacks
- Hard to audit
- See https://en.wikipedia.org/wiki/Comparison_of_hardware_random_number_generators
Hardware security modules
- Addresses side channel issues
- Certification available
- Compliance friendly, arguably best practice
- More expensive and harder to audit
CPU instruction
Intel's x86 RdRand instruction extension
- fast
- published design looks good
- available at programming level
RdRand controversial
- No programming access to internal entropy source
- Built-in whitener could be subverted
- Dopant attack undetectable
No such instruction available on ARM platform as of March 2014
Entropy from devices with other purposes
Hard drive
- 100 bits per minute with proper software per Cryptographic Randomness from Air Turbulence in Disk Drives, Don Davis, Ross Ihaka, and Philip Fenstermacher, 1994
- Does this paper apply to more modern hard drives?
- Does not apply to solid state drives (SSD)
System state
- Uninitialized RAM at startup eg
- operating system dependent
- Fragile, technology updates can change things
Sound input
- main reference Turbid
- good source when available
- data centers have high ambient sound levels http://storageservers.wordpress.com/2014/01/10/how-to-reduce-data-center-noise/
Video camera
- even low end VGA cameras have 640X480 = 307,200 pixel sensors
- multi-mega-pixel cameras common
- Many sources of noise from image capture physics
- built in compression removes some entropy, but not all
- imaging active scenes add separate source of entropy
- streamers in fan
- aquarium bubbler, with or without fish
- Lavarand patent
- candy or dice dumped on a tray as example. What could machine vision recover from image?
Accelerometer
- common to smart phones, tablets
- inexpensive
- digital I2C interface
- analog to GPIO pin per axis
- buzzer to stimulate static systems
- remove low-pass filter capacitor?
Radio
- WiFi, Bluetooth, cellular network
- Do APIs reveal random data?
Euro TV USB dongles
- USB dongles designed to receive European DVB-T (Digital Video Broadcasting — Terrestrial) broadcasts
- Units that use the Realtek RTL2832U chip are inexpensive (~$20) and widely available
- RTL2832U chip allows access to raw 8-bit samples at 2.5+ mega-samples/second
- Extensive software available from software-defined radio (SDR) experimenters
- low level drivers available for most platforms [1]
- Up-converter board available with wide-band zener noise generator [2]
- Receiver noise probably adequate for entropy harvesting
Network activity
- Limited availability at startup
- Can possibly be controlled remotely
Radiation detector
- Geiger tube
- Modified smoke alarm
User input
- keyboard timing
- mouse or other pointing device
- accelerometer
- asking user to input random data, e.g. dice throws, currency serial numbers
- human choices too predictable, but precisely measured movements are not
Home brew
- Maker movement
- Arduino
- Digispark, ATtiny85
- less is more
Mechanical sources
Dice
- cubic (d6)
- other
- effect of bias
- Shaken vs stirred
- possible camera subject
Playing cards
- log2 (52!) = 225.581
Bad sources
Program library random function
- often have small internal state (16, 32 or 48 bits)
- often seeded by low entropy source such as system clock
- poor quality PRNGs used, e.g. linear congruential
- better algorithms such as Mersenne Twister still not recommended
- Possible exceptions:
- SystemRandom class and os.urandom() in Python
- Intel's cryptgenrandom?,
- Java SecureRandom??
On line services
- Web traffic subject to interception
- Securing connection requires prior source of randomness
- may be useful for time stamp purposes, e.g. NIST beacon
White or pink noise generators
- Sold for privacy purposes and for calibrating audio systems
- Often shift register based, very small state
- Zener based ok, if this can be determined reliably