3 ms·
This is one of these approaches that are for all practical purposes completely useless. There's basically only three problems generating good randomness: 1. Ve
by hannob 7y ago
This is one of these approaches that are for all practical purposes completely useless.
There's basically only three problems generating good randomness:
1. Very early during boot you don't have a lot of good sources.
2. On very constrained devices you have limited external input.
3. Bugs in the implementation.
Randomness from soundcards doesn't help with any of these. They probably aren't yet initialized at the point in time where it matters most, they don't exist for the most problematic devices and bugs are bugs, no matter what your source of randomness.
- bigiain 7y ago> Randomness from soundcards doesn't help with any of these. "Randomness from soundcards" is also spectacularly unlikely to help on the cloud. Pretty sure they don't fit SoundBlaster16s to EC2 instances or Digital Ocean Droplets...
- simias 7y agoGiven that these instances are typically virtualized I wouldn't be surprised if you could extract a decent amount of entropy just by using the system timings (interrupts, RTC sampling etc...) given that they would be affected by the other running systems. And of course there's always the network card. In my experience it's not usually super difficult to get a decent amount of entropy on complex desktop or servers, it's only a real issue on simple embedded hardware where you might have no way to sample the environment and all the timings are ultra-deterministic. In this case I've resorted to using temperature measurements and fan speed as a source of entropy during early boot, which isn't ideal.
- tinus_hn 7y agoIt would seem quite helpful if these virtual machines provided a virtual device that gives random numbers provided by the host device.
- pjc50 7y ago> given that they would be affected by the other running systems Philosophically, does that make it more or less random? The whole category of side-channels suggests that there are problems with sharing a system like this. There's also the philosophical question of how cryptographically secure a fully virtual system can be when the host has full inspection and control capability. If you're running in the cloud you need to think carefully about how to delegate this to the platform if at all possible.
- skrebbel 7y agoI want a cloud version of Dr. Sbaitso!
- simias 7y agoIt could potentially help with 1 if you have some early bootstrap code to configure the sound card and get some samples. I agree with your general point however.
- atoav 7y agoI probably don’t know enough about computers, but wouldn’t there be a way to use e.g. the digital outputs of a DAC directly even in the earliest part of boot? Is there a good reason why CPUs aren’t doing this already?
- pjc50 7y agoWell, if you have one, and if the thing it's listening to is sufficiently random - both of which are in question here. This is sort of the problem the CPU random number generator is intended to solve, but see the discussion on trust.