10 ms·

USB True Random Number Generator

58 points by frossie 16y ago

mbreese 16y ago
Is the lack of entropy really a bottleneck in a server?
- scdlbx 16y ago
  If the application running on the server needs to generate a lot of random numbers, yes.
  - JoachimSchipper 16y ago
    Only if they need to be cryptographically secure - a PRNG, occasionally seeded with "real" entropy, is sufficient for almost all uses.
- mey 16y ago
  High volume SSL/SSH traffic. Systems can be configured to fall back to insecure random number generator under load but it creates an attack vector where you intentionally DoS a system, then have more leverage to crack the encryption based on the weak(read predictable) random data the encryption is based on. The practicality of such an attack is beyond my knowledge.
- davidu 16y ago
  Yes, it can be. In addition to a security issue making timing attacks more practical if an attacker knows they can deplete the entropy pool in a repeatable fashion.
nysauhem 16y ago
It never says that it generates true random numbers, just a "better" random
- brianto2010 16y ago
  From the 'tech' page: > "...it has a pair of devices that are wired up in such a way that as a high potential is applied across them, where electrons do not normally flow in this direction and would be blocked, the high voltage compresses the semiconduction gap sufficiently that the occasional stray electron will quantum tunnel through the P-N junction. (This is sometimes referred to as avalanche noise.) When this happens is unpredictable, and this is what the Entropy Key measures." 'Unpredictable' would qualify as random.
rubidium 16y ago
I like this one (http://www.idquantique.com/true-random-number-generator/quantis-usb-pcie-pci.html http://www.idquantique.com/true-random-number-generator/quan...) better. If I understand both correctly, the Quantis one generates a random number that didn't exist before generation due to quantum measurement principles, whereas the Simtec one uses a high noise environment in which the number does exist before measurement.
- hga 16y ago
  They look very nice and are high output (4Mbps to 16Mbps max for the PCIe version) but are quite a bit more expensive, 890 € to 1165 € quantity one.
- Confusion 16y ago
  You're repeating nonsensical marketspeak. What does "a number that didn't exist before ..." even mean? And what does "quantum measurement principles" mean? I'll tell you: it means diddly squat. The device the article is about measures electron flow through an electronic component through which 'usually' no electrons flow. That electrons flow in this device, is because they tunnel through the potential barrier. That's a quantum effect if there ever was one. Converting the presence of electron flow into a number means you construct these numbers on the fly. The numbers did not 'exist before', for any reasonable meaning of that term.
- Robin_Message 16y ago
  Acutally, Simtec states: "each 256 bit block of data handed to the host was formed from somewhere in the region of 3840 bits read from the quantum generators." Yes, you can buy "quantum generators" for only £36! Seriously though, the noise that Simtec is measuring is unpredictable and based on a quantum process (electron tunnelling.)
randomwalker 16y ago
This is silly. The whole reason that cryptographic random number generators exist is to avoid the need for lots of entropy. You can start from 80 bits and "bootstrap" it to whatever quantity of random bits you need (and the seed entropy needed is available from /dev/random). PRNGs come with the guarantee that telling the difference from "true" random numbers is a hard problem. You might claim that the hardness guarantees of PRNGs are not enough for you -- they are based on some assumptions after all -- but that is a specious objection, because those are the same assumptions that underlie all of digital security and e-commerce.
- tudorachim 16y ago
  I think the main advantage is that this RNG gives you the same results as a crypto-strong PRNG, but much faster. That said, I didn't see any benchmarks on their site.
- dododo 16y ago
  what are these guarantees you refer to? most pass a battery of tests e.g., diehard: http://www.stat.fsu.edu/pub/diehard/ http://www.stat.fsu.edu/pub/diehard/ but if you give a PRNG x bits of entropy, then it can produce at most x bits of entropy over its entire output. all PRNGs have cycles: that is, they'll produce random numbers x[1], x[2], ... , x[n], then random number x[n+1] = x[1], x[n+2] = x[2], .... often n isn't as big as you'd like, and sometimes there are correlations among x[i] and x[i+k] you really don't want (linear congruent generators have this problem).
  - stcredzero 16y ago
    Run the output through a hash function, and also get another 80 bits of entropy before you get to the critical n where your generator repeats.
    - dododo 16y ago
      are you sure? the PRNG is a deterministic function of its seed. the hash is a deterministic function of the output. if you do the math and calculate the entropy (this isn't hard) you'll see that the total entropy is still 80 bits because the distributions of the PRNG output given the seed, and of the hash given the output have no entropy. the marginal entropy of the PRNG is 80 bits if you don't observe the seed. another way of seeing this is via the data processing inequality: http://www.neng.usu.edu/classes/ece/7680/lecture3/node2.html http://www.neng.usu.edu/classes/ece/7680/lecture3/node2.html
maushu 16y ago
Notice on how they use "high-quality" in the first three paragraphs?
hga 16y ago
Quantity 1 £36.00 with plenty of quantity discounts. Might be just the thing to make sure your VMs have enough entropy (I've read this can be an issue when they start up).
aidenn0 16y ago
I don't know if things are improved, but the last time I looked into HW random number generators, it was RS-232 connected ones, and the quality control was terrible a fairly high percentage of them generated very low quality random numbers. You would think you could mitigate this by xoring two of them together, but this made things much worse since 2 connected to the same outlet tended to be somewhat correlated! My impression of the HW random number generator industry was that it was all snake oil, only the people selling them didn't necessarily know that was true. Se also: http://web.archive.org/web/20011027002011/http://dilbert.com/comics/dilbert/archive/images/dilbert2001182781025.gif http://web.archive.org/web/20011027002011/http://dilbert.com... [edit] The technical section of the webpage[1] directly addresses most of the problems that the RS-232 devices I looked into a number of years ago had; namely it detects when the diodes are going bad, and tries to not exceed the estimated entropy rate (the RS-232 devices just blindly XORed them together at a predefined bitrate; boxes typically had 4 diodes, since 1 or more was bad in almost all shipping boxes). My experience was so bad with those devices though that I would want to spend a lot of time with any HW device before trusting it. 1) http://www.entropykey.co.uk/tech/ http://www.entropykey.co.uk/tech/
- statictype 16y ago
  >fairly high percentage of them generated very low quality random numbers How do you judge the quality of a series of random numbers?
  - po 16y ago
    You run a bunch of Diehard tests on them: http://en.wikipedia.org/wiki/Diehard_tests http://en.wikipedia.org/wiki/Diehard_tests
    - po 16y ago
      The best part of testing random number generators is playing 200,000 games of craps. My boss protested, but I just questioned his commitment to security…
  - ciupicri 16y ago
brianobush 16y ago
In the past, I used random numbers from: http://www.fourmilab.ch/hotbits/ http://www.fourmilab.ch/hotbits/ sourced from radioactive decay. The only issue I could see was the daily limit, but I only needed several kilobytes of randomness at any one time.
sliverstorm 16y ago
Considering the ultimate doom of the universe is very possibly infinite entropy, sometimes it bemuses me on a philosophical level that we try so hard to accelerate the process.
- jim_dot 16y ago
  I'm all for protecting our children from the harmful effects of entropy, but not our children's children because I don't think that kids should be having sex.
- pyre 16y ago
  The only thing that I could come up with for 'infinite entropy' in Google was a piece about how 'big bangs' start from nothingness in empty space when the Universe 'cools off' or becomes 'too thin.' In that case, it seems like infinite entropy isn't necessarily the 'doom' of the Universe.
  - sliverstorm 16y ago
    It is in the sense that nothing will be left, and the space-wide temperature will be arbitrarily close to zero K I mean, the Universe wouldn't vanish or explode. We'd just all be dead, and it'd stop being interesting, the same way your magnesium strip is pretty boring and useless once it's finished burning.
stcredzero 16y ago
What about collecting microphone input and running it through a hash?
- dazzawazza 16y ago
  That is a recognised method but it does have it's own failings. Certainly in server rooms although it seems noisy to us there are patterns that can still be generated. Another similar method is to take static from radio waves. While random it's unfortunately hackable by someone who has a radio transmitter and can get close enough to your antenna (the same can be done with the microphone). I worked at a poker startup and sourcing random numbers is both a political and mathematical nightmare.
  - stcredzero 16y ago
    Add another noisemaker with a chaotic component, like a Pacinko ball game with an automatic ball feed. Hashing the output will obliterate the patterns.
- lutorm 16y ago
  Why not add a small amount of radioactive material and measure decays?
samlittlewood 16y ago
A GPL hardware RNG, using a bunch of ring oscillators in a CPLD: http://warmcat.com/_wp/whirlygig-rng/ http://warmcat.com/_wp/whirlygig-rng/
AdamN 16y ago
One of their prime arguments is about the 4KB bucket available for random numbers on a standard Linux installation. Couldn't/Shouldn't that be raised to 1MB or so for server installations and that would solve the bandwidth problem if not the randomness problem?
- AdamN 16y ago
  Does anybody know configuration options for managing this BTW?

58 points by frossie 16y ago

mbreese 16y ago

Is the lack of entropy really a bottleneck in a server?

scdlbx 16y ago
If the application running on the server needs to generate a lot of random numbers, yes.
- JoachimSchipper 16y ago
  Only if they need to be cryptographically secure - a PRNG, occasionally seeded with "real" entropy, is sufficient for almost all uses.
mey 16y ago
High volume SSL/SSH traffic. Systems can be configured to fall back to insecure random number generator under load but it creates an attack vector where you intentionally DoS a system, then have more leverage to crack the encryption based on the weak(read predictable) random data the encryption is based on. The practicality of such an attack is beyond my knowledge.
davidu 16y ago
Yes, it can be. In addition to a security issue making timing attacks more practical if an attacker knows they can deplete the entropy pool in a repeatable fashion.

nysauhem 16y ago

It never says that it generates true random numbers, just a "better" random

brianto2010 16y ago
From the 'tech' page: > "...it has a pair of devices that are wired up in such a way that as a high potential is applied across them, where electrons do not normally flow in this direction and would be blocked, the high voltage compresses the semiconduction gap sufficiently that the occasional stray electron will quantum tunnel through the P-N junction. (This is sometimes referred to as avalanche noise.) When this happens is unpredictable, and this is what the Entropy Key measures." 'Unpredictable' would qualify as random.

rubidium 16y ago

I like this one (http://www.idquantique.com/true-random-number-generator/quantis-usb-pcie-pci.html http://www.idquantique.com/true-random-number-generator/quan...) better. If I understand both correctly, the Quantis one generates a random number that didn't exist before generation due to quantum measurement principles, whereas the Simtec one uses a high noise environment in which the number does exist before measurement.

hga 16y ago
They look very nice and are high output (4Mbps to 16Mbps max for the PCIe version) but are quite a bit more expensive, 890 € to 1165 € quantity one.
Confusion 16y ago
You're repeating nonsensical marketspeak. What does "a number that didn't exist before ..." even mean? And what does "quantum measurement principles" mean? I'll tell you: it means diddly squat. The device the article is about measures electron flow through an electronic component through which 'usually' no electrons flow. That electrons flow in this device, is because they tunnel through the potential barrier. That's a quantum effect if there ever was one. Converting the presence of electron flow into a number means you construct these numbers on the fly. The numbers did not 'exist before', for any reasonable meaning of that term.
Robin_Message 16y ago
Acutally, Simtec states: "each 256 bit block of data handed to the host was formed from somewhere in the region of 3840 bits read from the quantum generators." Yes, you can buy "quantum generators" for only £36! Seriously though, the noise that Simtec is measuring is unpredictable and based on a quantum process (electron tunnelling.)

randomwalker 16y ago

This is silly. The whole reason that cryptographic random number generators exist is to avoid the need for lots of entropy. You can start from 80 bits and "bootstrap" it to whatever quantity of random bits you need (and the seed entropy needed is available from /dev/random). PRNGs come with the guarantee that telling the difference from "true" random numbers is a hard problem. You might claim that the hardness guarantees of PRNGs are not enough for you -- they are based on some assumptions after all -- but that is a specious objection, because those are the same assumptions that underlie all of digital security and e-commerce.

tudorachim 16y ago
I think the main advantage is that this RNG gives you the same results as a crypto-strong PRNG, but much faster. That said, I didn't see any benchmarks on their site.
dododo 16y ago
what are these guarantees you refer to? most pass a battery of tests e.g., diehard: http://www.stat.fsu.edu/pub/diehard/ http://www.stat.fsu.edu/pub/diehard/ but if you give a PRNG x bits of entropy, then it can produce at most x bits of entropy over its entire output. all PRNGs have cycles: that is, they'll produce random numbers x[1], x[2], ... , x[n], then random number x[n+1] = x[1], x[n+2] = x[2], .... often n isn't as big as you'd like, and sometimes there are correlations among x[i] and x[i+k] you really don't want (linear congruent generators have this problem).
- stcredzero 16y ago
  Run the output through a hash function, and also get another 80 bits of entropy before you get to the critical n where your generator repeats.
  - dododo 16y ago
    are you sure? the PRNG is a deterministic function of its seed. the hash is a deterministic function of the output. if you do the math and calculate the entropy (this isn't hard) you'll see that the total entropy is still 80 bits because the distributions of the PRNG output given the seed, and of the hash given the output have no entropy. the marginal entropy of the PRNG is 80 bits if you don't observe the seed. another way of seeing this is via the data processing inequality: http://www.neng.usu.edu/classes/ece/7680/lecture3/node2.html http://www.neng.usu.edu/classes/ece/7680/lecture3/node2.html

maushu 16y ago

Notice on how they use "high-quality" in the first three paragraphs?

hga 16y ago

Quantity 1 £36.00 with plenty of quantity discounts. Might be just the thing to make sure your VMs have enough entropy (I've read this can be an issue when they start up).

aidenn0 16y ago

I don't know if things are improved, but the last time I looked into HW random number generators, it was RS-232 connected ones, and the quality control was terrible a fairly high percentage of them generated very low quality random numbers. You would think you could mitigate this by xoring two of them together, but this made things much worse since 2 connected to the same outlet tended to be somewhat correlated! My impression of the HW random number generator industry was that it was all snake oil, only the people selling them didn't necessarily know that was true. Se also: http://web.archive.org/web/20011027002011/http://dilbert.com/comics/dilbert/archive/images/dilbert2001182781025.gif http://web.archive.org/web/20011027002011/http://dilbert.com... [edit] The technical section of the webpage[1] directly addresses most of the problems that the RS-232 devices I looked into a number of years ago had; namely it detects when the diodes are going bad, and tries to not exceed the estimated entropy rate (the RS-232 devices just blindly XORed them together at a predefined bitrate; boxes typically had 4 diodes, since 1 or more was bad in almost all shipping boxes). My experience was so bad with those devices though that I would want to spend a lot of time with any HW device before trusting it. 1) http://www.entropykey.co.uk/tech/ http://www.entropykey.co.uk/tech/

statictype 16y ago
>fairly high percentage of them generated very low quality random numbers How do you judge the quality of a series of random numbers?
- po 16y ago
  You run a bunch of Diehard tests on them: http://en.wikipedia.org/wiki/Diehard_tests http://en.wikipedia.org/wiki/Diehard_tests
  - po 16y ago
    The best part of testing random number generators is playing 200,000 games of craps. My boss protested, but I just questioned his commitment to security…
- ciupicri 16y ago

brianobush 16y ago

In the past, I used random numbers from: http://www.fourmilab.ch/hotbits/ http://www.fourmilab.ch/hotbits/ sourced from radioactive decay. The only issue I could see was the daily limit, but I only needed several kilobytes of randomness at any one time.

sliverstorm 16y ago

Considering the ultimate doom of the universe is very possibly infinite entropy, sometimes it bemuses me on a philosophical level that we try so hard to accelerate the process.

jim_dot 16y ago
I'm all for protecting our children from the harmful effects of entropy, but not our children's children because I don't think that kids should be having sex.
pyre 16y ago
The only thing that I could come up with for 'infinite entropy' in Google was a piece about how 'big bangs' start from nothingness in empty space when the Universe 'cools off' or becomes 'too thin.' In that case, it seems like infinite entropy isn't necessarily the 'doom' of the Universe.
- sliverstorm 16y ago
  It is in the sense that nothing will be left, and the space-wide temperature will be arbitrarily close to zero K I mean, the Universe wouldn't vanish or explode. We'd just all be dead, and it'd stop being interesting, the same way your magnesium strip is pretty boring and useless once it's finished burning.

stcredzero 16y ago

What about collecting microphone input and running it through a hash?

dazzawazza 16y ago
That is a recognised method but it does have it's own failings. Certainly in server rooms although it seems noisy to us there are patterns that can still be generated. Another similar method is to take static from radio waves. While random it's unfortunately hackable by someone who has a radio transmitter and can get close enough to your antenna (the same can be done with the microphone). I worked at a poker startup and sourcing random numbers is both a political and mathematical nightmare.
- stcredzero 16y ago
  Add another noisemaker with a chaotic component, like a Pacinko ball game with an automatic ball feed. Hashing the output will obliterate the patterns.
lutorm 16y ago
Why not add a small amount of radioactive material and measure decays?

samlittlewood 16y ago

A GPL hardware RNG, using a bunch of ring oscillators in a CPLD: http://warmcat.com/_wp/whirlygig-rng/ http://warmcat.com/_wp/whirlygig-rng/

AdamN 16y ago

One of their prime arguments is about the 4KB bucket available for random numbers on a standard Linux installation. Couldn't/Shouldn't that be raised to 1MB or so for server installations and that would solve the bandwidth problem if not the randomness problem?

AdamN 16y ago
Does anybody know configuration options for managing this BTW?