6 ms·

> magnetometer, accelerometer, simple GPS, At boot time, on a server sitting in a rack beside thousands of others ... how are these going to help any? They ain

> magnetometer, accelerometer, simple GPS, At boot time, on a server sitting in a rack beside thousands of others ... how are these going to help any? They aint moving and the RF/energy environment around them should be steady state or well within characterize-able bounds of noise. "Random enough" is a metaphysical question when you get into it. If an RTLSDR stick and a site customized munger script can't provide enough entropy for the entire data center you've fallen into a Purity spiral and will never be happy, anyway.

dgan 5y ago
i am pretty sure radioctive decay is random, and it's not metaphysical
- h2odragon 5y ago
  Ah, but is your sample still live enough to be "cryptographic grade" random? Is the hardware that measures the source and the software that reports it subject to any periodicity that you don't know about but your attackers might? (Some) People who study this often get lost down the rabbit hole and come out thinking the universe is deterministic.
  - User23 5y ago
    Or, it's what one of my ex-NSA buddies told me: we almost never break the encryption, we break the implementation, because that's where the errors are. The same can assuredly apply to capturing entropy.
    - LinuxBender 5y ago
      100% this. WEP WiFi was an infamous old example. The encryption was solid but the implementation was poor and could be easily broken.
  - CaptainNegative 5y ago
    Any distribution with a sufficient amount of entropy can be turned into "cryptographic-grade" randomness source using randomness extractors [1]. These work independently of any outside factors that might be trying to sneak signal (e.g. periodicity) into the noise -- as long as you can prove there's sufficient entropy to start with, you're good to go. [1] https://en.wikipedia.org/wiki/Randomness_extractor https://en.wikipedia.org/wiki/Randomness_extractor
    - HelloNurse 5y ago
      Low-intensity radiation is random enough, but it's slow: your device is necessarily twiddling thumbs between a detected event and the next, and entropy is mostly proportional to the number of events (for example, almost n bits from what of 2^n identical units is hit by the next particle).
      - eternityforest 5y ago
        Once you get 16-48ish bytes depending on paranoia you can just rely on crypto
bloopernova 5y ago
Purity spiral True that. I hadn't considered servers sitting in datacentres. Makes me wonder how AWS/Azure/Google manage randomness.
- csunbird 5y ago
  Well, Cloudflare uses lava lamps. https://www.cloudflare.com/de-de/learning/ssl/lava-lamp-encryption/ https://www.cloudflare.com/de-de/learning/ssl/lava-lamp-encr...
  - ComputerGuru 5y ago
    They don’t use them (read the details); they could fall back to using them. And it’s a stupid publicity stunt. And even then, they would use them via an ipcam - something probably way less secure than any rdrand or lava lamp.
    - daniel-cussen 5y ago
      It is and it isn't, in a sufficiently catastrophic scenario they might help for real. Note also most people have never seen a real lava lamp, only digital reproductions, like the one in Day of the Tentacle. Not the same thing.
      - cthalupa 5y ago
        There are many other more practical sources of random number generation, including ones that are non-deterministic due to quantum effects. SGI did it for fun, and obviously someone at Cloudflare was a fan. I'm also confused by the second statement. You believe that more people have seen lava lamps in video games and similar than ones in person, or photos/videos of real ones? This seems unlikely to me.
        daniel-cussen 5y ago
        Yes as a matter of fact I do believe people see lava lamps in digital media more often than in real life. I am one example of such a person. Lava lamps are an American thing largely, so if you want to see them you need to bring one from America or go to America to see it. What is the alternative? Lava lamp in the media, where you can look at it many times, but it is always a rerun.
criddell 5y ago
There are true hardware random number generators. IIRC, one example is based on a reverse biased diode. Due random quantum effects, an electron flow backwards occasionally and measuring that gives you a source of real randomness.
- PaulHoule 5y ago
  The dedicated RNG scares the paranoid the most because it is an obvious target for corruption.
  - dboreham 5y ago
    Paranoid implies some aspect of unjustified fear. In this case the fear is quite justified.
    - rrdharan 5y ago
      What’s the point of not trusting the hardware entropy source while still trusting the rest of the chip / hardware?
      - adrian_b 5y ago
        For the rest of the chip / hardware there are at least some chances to test what they do and discover any suspicious behavior. Any well-designed back-door in a black-box RNG cannot be discovered by testing. Except for the RNG, the only other thing that cannot be trusted at all is because your computer/smartphone might allow remote connections to a management component of its hardware, regardless how you configure it. Wired connections are not very dangerous, because you can pass them trough an external firewall and you can block anything suspicious. The problem is with the WiFi connections, e.g. of the WiFi Intel chipsets in laptops, and obviously the least under your control are the mobile phones. However even a smartphone can be put in a metal box to ensure that nobody can connect to it (even if that also defeats the main use of a mobile phone, it can make sense if you are worried about remote control only sometimes, not permanently). On the other hand, a RNG that cannot be verified to be what it claims to be, is completely useless.
qbasic_forever 5y ago
A datacenter scenario seems like a good fit for a centralized source of entropy, like a server with a dedicated high quality entropy source (maybe some kind of geiger counter/nuclear decay based source?). Very early in the boot process query the entropy server for a truly random seed and go from there to initialize your random algorithm, kind of like NTP and network time sources. Security would be something to pay attention to as you wouldn't want an attacker to ever get control of providing entropy.
- eternityforest 5y ago
  Assuming you fully trust your PRNG algorithm, you really only need to do this once, generate a seed, then hash it with the current time(Assuming you have a trusted source), and whatever other entropy you have, plus the untrusted hardware RNG. A backdoored RNG is unlikely to ever repeat patterns, that would be obvious, so it should be trustworthy enough to create a unique number. It also probably, but not definitely can't phone home without someone noticing(Unless it can target specific people who aren't looking), and if it can, it can also send anything else it wants anyway. An insecure but unique seed hashed with a secret machine specific value should be safe, it's not like they can manipulate the final value without having a way to break the hash, right? You could even reuse the secret between machines as long as the attacker doesn't know it and everything else in the hash is unique. Whatever network boot thingy or ansible job could provision random seeds when it updates the OS.
- lucb1e 5y ago
  > A datacenter scenario seems like a good fit for a centralized source of entropy "One ring to rule them all" is the quote my inner security sense immediately reaches for

dgan 5y ago

i am pretty sure radioctive decay is random, and it's not metaphysical

h2odragon 5y ago
Ah, but is your sample still live enough to be "cryptographic grade" random? Is the hardware that measures the source and the software that reports it subject to any periodicity that you don't know about but your attackers might? (Some) People who study this often get lost down the rabbit hole and come out thinking the universe is deterministic.
- User23 5y ago
  Or, it's what one of my ex-NSA buddies told me: we almost never break the encryption, we break the implementation, because that's where the errors are. The same can assuredly apply to capturing entropy.
  - LinuxBender 5y ago
    100% this. WEP WiFi was an infamous old example. The encryption was solid but the implementation was poor and could be easily broken.
- CaptainNegative 5y ago
  Any distribution with a sufficient amount of entropy can be turned into "cryptographic-grade" randomness source using randomness extractors [1]. These work independently of any outside factors that might be trying to sneak signal (e.g. periodicity) into the noise -- as long as you can prove there's sufficient entropy to start with, you're good to go. [1] https://en.wikipedia.org/wiki/Randomness_extractor https://en.wikipedia.org/wiki/Randomness_extractor
  - HelloNurse 5y ago
    Low-intensity radiation is random enough, but it's slow: your device is necessarily twiddling thumbs between a detected event and the next, and entropy is mostly proportional to the number of events (for example, almost n bits from what of 2^n identical units is hit by the next particle).
    - eternityforest 5y ago
      Once you get 16-48ish bytes depending on paranoia you can just rely on crypto

bloopernova 5y ago

Purity spiral True that. I hadn't considered servers sitting in datacentres. Makes me wonder how AWS/Azure/Google manage randomness.

csunbird 5y ago
Well, Cloudflare uses lava lamps. https://www.cloudflare.com/de-de/learning/ssl/lava-lamp-encryption/ https://www.cloudflare.com/de-de/learning/ssl/lava-lamp-encr...
- ComputerGuru 5y ago
  They don’t use them (read the details); they could fall back to using them. And it’s a stupid publicity stunt. And even then, they would use them via an ipcam - something probably way less secure than any rdrand or lava lamp.
  - daniel-cussen 5y ago
    It is and it isn't, in a sufficiently catastrophic scenario they might help for real. Note also most people have never seen a real lava lamp, only digital reproductions, like the one in Day of the Tentacle. Not the same thing.
    - cthalupa 5y ago
      There are many other more practical sources of random number generation, including ones that are non-deterministic due to quantum effects. SGI did it for fun, and obviously someone at Cloudflare was a fan. I'm also confused by the second statement. You believe that more people have seen lava lamps in video games and similar than ones in person, or photos/videos of real ones? This seems unlikely to me.
      - daniel-cussen 5y ago
        Yes as a matter of fact I do believe people see lava lamps in digital media more often than in real life. I am one example of such a person. Lava lamps are an American thing largely, so if you want to see them you need to bring one from America or go to America to see it. What is the alternative? Lava lamp in the media, where you can look at it many times, but it is always a rerun.

criddell 5y ago

There are true hardware random number generators. IIRC, one example is based on a reverse biased diode. Due random quantum effects, an electron flow backwards occasionally and measuring that gives you a source of real randomness.

PaulHoule 5y ago
The dedicated RNG scares the paranoid the most because it is an obvious target for corruption.
- dboreham 5y ago
  Paranoid implies some aspect of unjustified fear. In this case the fear is quite justified.
  - rrdharan 5y ago
    What’s the point of not trusting the hardware entropy source while still trusting the rest of the chip / hardware?
    - adrian_b 5y ago
      For the rest of the chip / hardware there are at least some chances to test what they do and discover any suspicious behavior. Any well-designed back-door in a black-box RNG cannot be discovered by testing. Except for the RNG, the only other thing that cannot be trusted at all is because your computer/smartphone might allow remote connections to a management component of its hardware, regardless how you configure it. Wired connections are not very dangerous, because you can pass them trough an external firewall and you can block anything suspicious. The problem is with the WiFi connections, e.g. of the WiFi Intel chipsets in laptops, and obviously the least under your control are the mobile phones. However even a smartphone can be put in a metal box to ensure that nobody can connect to it (even if that also defeats the main use of a mobile phone, it can make sense if you are worried about remote control only sometimes, not permanently). On the other hand, a RNG that cannot be verified to be what it claims to be, is completely useless.

qbasic_forever 5y ago

A datacenter scenario seems like a good fit for a centralized source of entropy, like a server with a dedicated high quality entropy source (maybe some kind of geiger counter/nuclear decay based source?). Very early in the boot process query the entropy server for a truly random seed and go from there to initialize your random algorithm, kind of like NTP and network time sources. Security would be something to pay attention to as you wouldn't want an attacker to ever get control of providing entropy.

eternityforest 5y ago
Assuming you fully trust your PRNG algorithm, you really only need to do this once, generate a seed, then hash it with the current time(Assuming you have a trusted source), and whatever other entropy you have, plus the untrusted hardware RNG. A backdoored RNG is unlikely to ever repeat patterns, that would be obvious, so it should be trustworthy enough to create a unique number. It also probably, but not definitely can't phone home without someone noticing(Unless it can target specific people who aren't looking), and if it can, it can also send anything else it wants anyway. An insecure but unique seed hashed with a secret machine specific value should be safe, it's not like they can manipulate the final value without having a way to break the hash, right? You could even reuse the secret between machines as long as the attacker doesn't know it and everything else in the hash is unique. Whatever network boot thingy or ansible job could provision random seeds when it updates the OS.
lucb1e 5y ago
> A datacenter scenario seems like a good fit for a centralized source of entropy "One ring to rule them all" is the quote my inner security sense immediately reaches for