7 ms·
Hardware random number generators tend to attract a lot of interest, but people should be aware that they don't solve any real problem. Every modern OS has a s
by hannob 5y ago
Hardware random number generators tend to attract a lot of interest, but people should be aware that they don't solve any real problem.
Every modern OS has a secure RNG. Except for the problem of early boot time entropy (which you can avoid if you have the right API calls that block before enough entropy has been collected), there's never been any major problem with those.
Otherwise the only problems with RNGs are either simple bugs (i.e. you're not really using the secure RNG) or people calling pseudorandom functions that weren't meant to be used for secure use cases.
- uluyol 5y agoI thought they were useful for embedded use cases, where there isn't much going on so it can take a long time for the OS to collect enough entropy.
- therein 5y agoThere is still quite a lot going on. Especially in the multi-core scenario.
- ur-whale 5y ago>Every modern OS has a secure RNG A strong statement, without much in the way of supporting evidence.
- adgjlsfhk1 5y agoWindows, Mac, IOS, and Linux do. By my count, that's somewhere between 99.5% and 99.9%
- 0xdeadb00f 5y agoBSDs do as well, I believe
- ur-whale 5y agoTe fact that modern os's have built in RNG is so blatantly obvious, it's clearly not what my comment was about. Your numbers say strictly nothing about the "secure" part.
- saagarjha 5y agoPeople don't really like their random calls to block for an arbitrary amount of time. Using a hardware random number generator to seed your PRNG quickly is a useful thing to have.
- RachelF 5y agoMost Intel and AMD CPUs in the last 8 years have had hardware RNGs that are based on shot noise of a reverse biased Zener diode, which is better than whatever thermal noise/RF this resistive setup is picking up.
- nullc 5y agoThey have a hardware RNG but it sure isn't based on a reverse biased diode. They claim to be ring oscillator based, though their operation is not independently verifiable. Their design-- using AES as a whitening postprocessing step-- would make it extremely easy for them to return something like an aes stream based just on a counter and secret key as a result of an almost undetectable attack.
- kurisukun 5y agoIn a way, the system does not guarantee there is no kleptographic attack either since the CPU acts like a black-box device
- nullc 5y agoTrue enough, though the AES DRBG output based HWRNGs would be a great target-- a highly specific nobus or near nobus attack with just a dopant change breaking a single gate... and then the RNG is just some fixed AES stream known to the attacker.
- RachelF 5y agoGood to know, I assumed they'd use the best available: https://en.wikipedia.org/wiki/Noise_generator https://en.wikipedia.org/wiki/Noise_generator
- nullc 5y agoAFAIK you can't just put a reverse bias diode generator in a processor because it requires a different process and relatively high voltages (as ICs go).
- nullc 5y ago> there's never been any major problem with those Sure there have been, e.g. CVE-2006-1833, CVE-2008-516, CVE-2013-5180, CVE-2014-4422, https://marc.info/?l=netbsd-current-users&m=136460321709597 https://marc.info/?l=netbsd-current-users&m=136460321709597 ... just to give some random examples. Of course, whatever yolo hwrng people use may be even worse off.