4 ms·

As an infosec pro, If I was in charge of a lottery RNG, I would require the use of a recent unmodified Linux or OpenBSD distro and simply use getrandom(2). Thes

by mrb 9y ago

As an infosec pro, If I was in charge of a lottery RNG, I would require the use of a recent unmodified Linux or OpenBSD distro and simply use getrandom(2). These custom RNG introduce 100% unnecessary complexity and risks. I am baffled none of them seem to do that and they need thirdparty certification procedures (who miss RNG flaws anyway.)

PhantomGremlin 9y ago
I'd take the output of getrandom() and XOR it with something like a quantum RNG. E.g. these guys claim their hardware is used by Lotteries and Gaming: http://www.idquantique.com/random-number-generation/quantis-random-number-generator/ http://www.idquantique.com/random-number-generation/quantis-... But, as Agent Mulder knew, "trust no one". So the above is necessary but not sufficient. Above all else, there must be constant vigilance.
- jk2323 9y ago
  "TRUE RANDOM NUMBER GENERATOR EXPLOITING THE RANDOMNESS OF QUANTUM PHYSICS" not sure what they mean by this. Likely it is just "avalanche noise". This is not very difficult. In fact, I build an hardware RNG that is based on avalanche noise (not my development): https://emergent.unpythonic.net/01257868826 https://emergent.unpythonic.net/01257868826
  - PhantomGremlin 9y ago
    Evaluating the veracity of their claims is way above my pay grade. They do have a PDF on their site: http://marketing.idquantique.com/acton/attachment/11868/f-004b/1/-/-/-/-/Quantum%20RNG%20White%20Paper.pdf http://marketing.idquantique.com/acton/attachment/11868/f-00... Basically, emit photons at a semi-transparent mirror. 50% go straight, 50% reflect 90 degrees. Have single-photon detectors at both directions. Quoting from their PDF: Figure 2 shows the block diagram of the Quantis random number generator. It consists of three subsystems. The first one is the core of the generator and contains the optical elements that are used to implement the random process and produce the random outcomes. It comprises a light emitting diode producing the photons, a transmission element, where the random process takes place, and two single-photon detectors – detectors with single-photon resolution – to record the outcomes. The optical subsystem is controlled by a synchronization and acquisition electronic circuit. This subsystem comprises a clock and triggering electronics for the photon source, as well the acquisition electronics for the single-photon detectors. The processing and interfacing subsystem perform statistical and hardware checks, as well as unbiasing of the sequence. Edit: the ID Quantique hardware is a bit pricey for hobbyists, starting at about 1000 euros. If I were building something for myself, I'd look here for inspiration: https://www.fourmilab.ch/hotbits/ https://www.fourmilab.ch/hotbits/ That hardware detects beta decay events. That's preferable to me than "avalanche noise". Not that there's anything fundamentally wrong with thermal noise or shot noise; it's that in real implementations the quality of results is very dependent on things such as quality of power supply. To me it's much simpler to correctly detect intervals between consecutive radioactive decay events. The downside to a cheap decay detector is that the number of events is much lower than what the commercial hardware provides. A few hundred bits per second versus a few million bits per second.
matt_wulfeck 9y ago
Pretty good open-hardware TRNGs out there, such as OneRNG. I'd probably attach it and let it mix the rng pool, but not draw from it directly.
teitelman 9y ago
I agree. Customization provides more opportunities for employees to rig the RNGs. My ideal RNG would be an off-the-shelf computer with a stock image and a < 20 line Python script to display numbers. This could be developed in less than a day and the entire process could be supervised by a third party. There are still trust issues which need to be dealt with (e.g. how are we downloading the image?). These issues could be dealt with with assistance/supervision from a third party or two. The problem is that lottery RNG vendors are selling a product. Lotteries like to see machines in custom boxes with custom user interfaces. The RNGs have hardcoded game parameters. Some are automated to produce numbers on a schedule without human interaction. Others require an operator to log in and select a game to produce numbers for. These RNGs contain thousands of lines of code. Some take the form of multiple programs and services. In some cases they even contain multiple machines. As an example I just ran sloccount on a source directory for one of these RNGs. Here's the (redacted) output: 62135 XXX cpp=62135 20447 XXX cs=20447 17642 XXX cpp=17642 9308 XXX cpp=5969,ansic=3339 4987 XXX cpp=4987 2414 XXX cs=2414 1926 XXX cpp=1926 1744 XXX cpp=1744 390 XXX cpp=390 150 XXX cpp=150 67 XXX cpp=67 35 XXX cpp=35 32 XXX cpp=32 ... Yeah. This RNG consists of over 120 thousand lines of code. The systems which this program runs on are set up by a single developer. This setup process is not supervised so even if the developer isn't able to slip something into the source code or the binaries he could in theory place something (e.g. a rootkit or something which simply replaces the RNG program on start) on the system itself.
- mrb 9y ago
  I take it you are in the industry. Interesting :)

by mrb 9y ago

PhantomGremlin 9y ago

I'd take the output of getrandom() and XOR it with something like a quantum RNG. E.g. these guys claim their hardware is used by Lotteries and Gaming: http://www.idquantique.com/random-number-generation/quantis-random-number-generator/ http://www.idquantique.com/random-number-generation/quantis-... But, as Agent Mulder knew, "trust no one". So the above is necessary but not sufficient. Above all else, there must be constant vigilance.

jk2323 9y ago
"TRUE RANDOM NUMBER GENERATOR EXPLOITING THE RANDOMNESS OF QUANTUM PHYSICS" not sure what they mean by this. Likely it is just "avalanche noise". This is not very difficult. In fact, I build an hardware RNG that is based on avalanche noise (not my development): https://emergent.unpythonic.net/01257868826 https://emergent.unpythonic.net/01257868826
- PhantomGremlin 9y ago
  Evaluating the veracity of their claims is way above my pay grade. They do have a PDF on their site: http://marketing.idquantique.com/acton/attachment/11868/f-004b/1/-/-/-/-/Quantum%20RNG%20White%20Paper.pdf http://marketing.idquantique.com/acton/attachment/11868/f-00... Basically, emit photons at a semi-transparent mirror. 50% go straight, 50% reflect 90 degrees. Have single-photon detectors at both directions. Quoting from their PDF: Figure 2 shows the block diagram of the Quantis random number generator. It consists of three subsystems. The first one is the core of the generator and contains the optical elements that are used to implement the random process and produce the random outcomes. It comprises a light emitting diode producing the photons, a transmission element, where the random process takes place, and two single-photon detectors – detectors with single-photon resolution – to record the outcomes. The optical subsystem is controlled by a synchronization and acquisition electronic circuit. This subsystem comprises a clock and triggering electronics for the photon source, as well the acquisition electronics for the single-photon detectors. The processing and interfacing subsystem perform statistical and hardware checks, as well as unbiasing of the sequence. Edit: the ID Quantique hardware is a bit pricey for hobbyists, starting at about 1000 euros. If I were building something for myself, I'd look here for inspiration: https://www.fourmilab.ch/hotbits/ https://www.fourmilab.ch/hotbits/ That hardware detects beta decay events. That's preferable to me than "avalanche noise". Not that there's anything fundamentally wrong with thermal noise or shot noise; it's that in real implementations the quality of results is very dependent on things such as quality of power supply. To me it's much simpler to correctly detect intervals between consecutive radioactive decay events. The downside to a cheap decay detector is that the number of events is much lower than what the commercial hardware provides. A few hundred bits per second versus a few million bits per second.

matt_wulfeck 9y ago

Pretty good open-hardware TRNGs out there, such as OneRNG. I'd probably attach it and let it mix the rng pool, but not draw from it directly.

teitelman 9y ago

I agree. Customization provides more opportunities for employees to rig the RNGs. My ideal RNG would be an off-the-shelf computer with a stock image and a < 20 line Python script to display numbers. This could be developed in less than a day and the entire process could be supervised by a third party. There are still trust issues which need to be dealt with (e.g. how are we downloading the image?). These issues could be dealt with with assistance/supervision from a third party or two. The problem is that lottery RNG vendors are selling a product. Lotteries like to see machines in custom boxes with custom user interfaces. The RNGs have hardcoded game parameters. Some are automated to produce numbers on a schedule without human interaction. Others require an operator to log in and select a game to produce numbers for. These RNGs contain thousands of lines of code. Some take the form of multiple programs and services. In some cases they even contain multiple machines. As an example I just ran sloccount on a source directory for one of these RNGs. Here's the (redacted) output: 62135 XXX cpp=62135 20447 XXX cs=20447 17642 XXX cpp=17642 9308 XXX cpp=5969,ansic=3339 4987 XXX cpp=4987 2414 XXX cs=2414 1926 XXX cpp=1926 1744 XXX cpp=1744 390 XXX cpp=390 150 XXX cpp=150 67 XXX cpp=67 35 XXX cpp=35 32 XXX cpp=32 ... Yeah. This RNG consists of over 120 thousand lines of code. The systems which this program runs on are set up by a single developer. This setup process is not supervised so even if the developer isn't able to slip something into the source code or the binaries he could in theory place something (e.g. a rootkit or something which simply replaces the RNG program on start) on the system itself.

mrb 9y ago
I take it you are in the industry. Interesting :)