6 ms·

OneRNG – Open Hardware Random Number Generator

80 points by Zababa 4y ago

Zababa 4y ago
A 2015 article from LWN about it: https://lwn.net/Articles/629714/ https://lwn.net/Articles/629714/ Previous discussion, with the designer in the thread (2014): https://news.ycombinator.com/item?id=8519801 https://news.ycombinator.com/item?id=8519801
teddyh 4y ago
> We are not aware of any other equivalent device that promotes this essential feature of security for you, the user. Really? What about the ChaosKey? https://altusmetrum.org/ChaosKey/ https://altusmetrum.org/ChaosKey/
- humanistbot 4y ago
  From your link: "ChaosKey is now out of production. They work great, but it took several years to sell our first production run, and shipping them from the US to other countries one at a time ended up dominating the net cost to most users. We might make more some day, but no promises!"
  - teddyh 4y ago
    Too bad; I have a bunch and they work fine.
hannob 4y ago
Usual caveat: Hardware RNGs don't really solve any practical problem, and are mostly based on urban legends about cryptography, e.g. the idea that you have to constantly refeed "lost" entropy in an RNG. The issues with RNGs usually come down to lack of use of a secure RNG, bugs within the RNG or early boot time entropy. Only the third may benefit in theory from a hardware RNG, but the devices that potentially have this problem usually don't come with an USB port, so it doesn't help either.
- dale_glass 4y ago
  I remember Linux running into a bunch of issues with boot time entropy. Some things were sometimes getting stuck on boot due to that. Also this "lost entropy" thing has long been a bane of VM servers, which could consume vast amounts of it. I think this changed fairly recently. And lots of things have USB ports these days, including things like commercial wifi access points, routers, switches, etc. Some of those have internal ones.
- dragontamer 4y ago
  All Intel and AMD chips come with a hardware RNG today: the RDRAND and RDSEED instructions. RDRAND is kinda-sorta like /dev/urandom, while RDSEED is /dev/random with stronger entropy guarantees. Linux didn't want to "trust" this hardware, for whatever reason. I guess there was that one time an AMD bug in the instruction returned all-zeros (or something similar). But as "long as the instruction is properly working", it is... well... working, lol. But its not like its really possible to test if its working correctly. -------- From that perspective, a hardware RNG needs to be "large" and "discrete" enough for humans to easily test and prove that its working, to create trust. Otherwise, hardware and/or firmware bugs could lead to a security problem. EDIT: if you are at a mass produced but don't verify kinda person, then you might as well use RDSEED instructions to get her entropy. Intel/AMD probably are good enough to prevent firmware / hardware bugs. I know that VMs also have an issue here: whether or not to make RDSEED deterministic/predictable or not. Should the future RDSEED instructions be saved in a VM snapshot?
  - jnwatson 4y ago
    You can (and are required to in certain environments) test for basic failures in your hardware RNG. The AMD bug was bad not because of the bug, but because it was obvious they had no built-in-test functionality.
  - garaetjjte 4y ago
    >RDRAND is kinda-sorta like /dev/urandom, while RDSEED is /dev/random with stronger entropy guarantees. /dev/urandom and /dev/random is almost the same nowadays, the only difference is that random will block after boot until enough entropy is collected, but it never "runs out" of entropy anymore.
anfractuosity 4y ago
Has anyone seen any open hardware optical RNGs out of interest, for high bandwidth generation?
- jnwatson 4y ago
  There isn't a good reason for high bandwidth hardware RNG. You seed a PRNG with a slow HW RNG and you're good to go.
  - genewitch 4y ago
    this is one school of thought, for sure.
  - nullc 4y ago
    A reason is if you're using a scheme that has information theoretic security, rather than computational, when instantiated with a TRNG. Hopefully adequately built computational security is sufficient for any purpose, but this is a certificational difference-- hopefully not one in practice but potentially one in the kind of guarantees that you can give. (E.g. you can't prove that someone doesn't secretly know how to invert a HMAC-DRBG to get its state given a large chunk of its output) It would be pretty foolish to use a IT security scheme just to destroy the property by using a DRBG to source its random numbers. That said, since TRNGs are mostly interesting to snake oil drinkers there is good reason to expect most TRNG to be poorly constructed. (E.g. it's really common to see then dropping output based on a NIST SP 800-22, thus technically resulting in a biased output).
  - anfractuosity 4y ago
    I'm mostly interested in optical HWRNGs from a curiosity about the single photon emitter, was just skimming a paper which seemed to indicate you can make one from a std. LED, which seemed very cool to me.
tonetheman 4y ago
This was mentioned somewhere on the site and it is abandoned but it seems like a great way to get some entropy also. From a software radio dongle. https://github.com/pwarren/rtl-entropy https://github.com/pwarren/rtl-entropy
- genewitch 4y ago
  I've used randio and rtl-entropy, and they work okay, but there's some - possibly legitimate - concerns that even a shielded device can be made to output arbitrary [enough] bits from a concentrated attack, should an adversary know you're using that for entropy. As far as generation, old webcams sealed inside of coffee cans painted as dark as possible on the inside, and then sealed to ensure no light gets in, can be used to generate bits pretty quickly. I haven't had time or inclination to mess with avalanching diodes/transistors/resistors to verify the randomness and immunity to environment, but i have used the above methods to test their entropy, and used it to generate One Time Pads. As per my HN profile, i used to be very into entropy research and methods; but lately my home - and homestead - life take up most of my time. and RDRAND et al use thermals from the dark silicon to generate ~1mhz of entropy (as of 2018,) which should be sufficient for practically any normal usage of entropy. A hardware entropy / RNG should only be needed if you are running something like a "lottery", you still need a verifiable "whitener", and you never touch "CSRNG" or "PRNG" anywhere.
  - tonetheman 4y ago
    Your comment is super interesting. I did not know you could get entropy from a dark web cam. Super cool stuff!
    - genewitch 4y ago
      as Joachim mentioned; and as i thought i replied already - all sensors have enough noise to be entropy sources. If you can quiesce a sensor - by putting it in a chamber that reduces whatever it senses, or otherwise reducing the input, you can grab "noise". MEMS sensors are notorious for being "noisy", and should always be looked at for cheap entropy sources. Followed by webcams in black chambers, webcams with a single photon source in a reflective chamber, anything that can pick up any RF whatsoever (including ADCs with signal and a resistor or inductor to ground), and so on up to thermals, Geiger detectors, avalanche silicon circuits, and beyond.
m463 4y ago
There's also the infinite noise rng: https://www.crowdsupply.com/leetronics/infinite-noise-trng https://www.crowdsupply.com/leetronics/infinite-noise-trng
- magicalhippo 4y ago
  One key difference (at least for some) is that the Infinite Noise project uses a completely hardware-defined USB chip[1], which has been decapped. Thus you could in theory buy a batch, decap a random selection and visually inspect to verify that it matches the reference. The OneRNG uses a more regular SoC, which is theoretically susceptible to supply chain issues like fakes or deliberate tampering. To their credit, they do mention this: There is one complex chip on the OneRNG which cannot be verified by eye. The CC2531 SoC (from Texas Instruments) is small, and it is theoretically possible that the chip fitted to your device has been tampered with or even been outright substituted for an alternative before you received your device. [1]: https://www.crowdsupply.com/13-37/infinite-noise-trng/updates/parallel-modular-entropy-multiplication-and-the-usb-chip https://www.crowdsupply.com/13-37/infinite-noise-trng/update...
sbf501 4y ago
I don't see a FIPS certification for it? I mean, at least show us some NIST 800-22 results. We already have a DRBG RFC to account for poor-entropy systems that has considerable research behind it. This seems pointless.
Forbo 4y ago
I've got an FST-01 that I've been meaning to set up with NeuG as a hobby project. Not sure if it would be worthwhile or if I would be better served spending my time on something else.
ur-whale 4y ago
> primarily from an avalanche diode circuit, Unfortunately, these diodes in avalanche mode degrade over time and it is unclear how stable the quality of the entropy derived from this analog circuit is over long periods of time.
ur-whale 4y ago
One of my favorite technique for building a hardware RNG uses a cheapo FPGA circuit (something like this: https://www.aliexpress.com/item/32241350256.html?spm=a2g0o.productlist.0.0.47da52e2vIZCiT&algo_pvid=da8182e6-75f6-4f81-96b7-3c5ab357b0b8&algo_exp_id=da8182e6-75f6-4f81-96b7-3c5ab357b0b8-17&pdp_ext_f=%7B%22sku_id%22%3A%2256011206743%22%7D&pdp_npi=2%40dis%21EUR%2154.2%2137.95%21%21%214.67%21%21%40210318b916659522513785493eca33%2156011206743%21sea&curPageLogUid=HOTcKVGFGvph https://www.aliexpress.com/item/32241350256.html?spm=a2g0o.p...) with a bunch of free-running high-frequency oscillators called ring oscillators (basically loops of NOT gates, which have a lot of phase noise, especially if they run hot) that are sampled at constant frequency. The entropy isn't very "clean" (lots of auto-correlation), but it's unpredictable enough to seed a crypto hard RNG which can also be built into the FPGA and operate at very high speed. It's also an increasing PITA to convince synthesis tools to actually emit ring oscillators, which they consider to be a design bug (which they almost always are, except in this specific case), but it's still possible. [EDIT]: a quick search on github yields: https://github.com/stnolting/neoTRNG https://github.com/stnolting/neoTRNG https://github.com/Netnod/rosc_entropy https://github.com/Netnod/rosc_entropy
- JoachimS 4y ago
  I was going to say that this is what we used as one of two entropy sources [0] in the Cryptech HSM. But the second link there is the fork of the Cryptech rosc entropy source we did for the FPGA based NTS server. ;-) The TRNG in the Tillitis Key 1 (TK1) we released a couple of weeks ago contain a version of the rosc entropy source. But I have now included a VN-decorrelator. And the actual oscillators are much simpler, cleaner. [0] The other entropy source in cryptech is an avalanche noise source outside of the FPGA. Both sources can be found here: https://git.cryptech.is/core/rng/avalanche_entropy/ https://git.cryptech.is/core/rng/avalanche_entropy/ https://git.cryptech.is/core/rng/rosc_entropy/ https://git.cryptech.is/core/rng/rosc_entropy/ The complete TRNG samples both sources (round robin) and creates a seed using SHA-512, with previous seed a part of the input. The seed is then used to initialize ChaCha20 as CSPRNG: https://git.cryptech.is/core/rng/trng/ https://git.cryptech.is/core/rng/trng/
  - ur-whale 4y ago
nimbius 4y ago
for those interested, you can do the same thing with a $20 usb dtv receiver and rngd using the rtl-sdr entropy project http://blog.cros13.net/2014/08/cheap-entropy-using-your-rtl-sdr-as.html?m=1 http://blog.cros13.net/2014/08/cheap-entropy-using-your-rtl-...
Geee 4y ago
The chip itself isn't verifiable, like the document says. It's possible that there's a backdoor. It's not likely, but it's not verifiable and you'll have to trust it.
JoachimS 4y ago
Given a suitable app, the Tillitis Key 1 works as a RNG. I have written a first version, and will release one in the public app repository in a week or so. https://github.com/tillitis/tillitis-key1 https://github.com/tillitis/tillitis-key1 https://github.com/tillitis/tillitis-key1-apps https://github.com/tillitis/tillitis-key1-apps

80 points by Zababa 4y ago

A 2015 article from LWN about it: https://lwn.net/Articles/629714/ https://lwn.net/Articles/629714/ Previous discussion, with the designer in the thread (2014): https://news.ycombinator.com/item?id=8519801 https://news.ycombinator.com/item?id=8519801

teddyh 4y ago

> We are not aware of any other equivalent device that promotes this essential feature of security for you, the user. Really? What about the ChaosKey? https://altusmetrum.org/ChaosKey/ https://altusmetrum.org/ChaosKey/

humanistbot 4y ago
From your link: "ChaosKey is now out of production. They work great, but it took several years to sell our first production run, and shipping them from the US to other countries one at a time ended up dominating the net cost to most users. We might make more some day, but no promises!"
- teddyh 4y ago
  Too bad; I have a bunch and they work fine.

hannob 4y ago

Usual caveat: Hardware RNGs don't really solve any practical problem, and are mostly based on urban legends about cryptography, e.g. the idea that you have to constantly refeed "lost" entropy in an RNG. The issues with RNGs usually come down to lack of use of a secure RNG, bugs within the RNG or early boot time entropy. Only the third may benefit in theory from a hardware RNG, but the devices that potentially have this problem usually don't come with an USB port, so it doesn't help either.

dale_glass 4y ago
I remember Linux running into a bunch of issues with boot time entropy. Some things were sometimes getting stuck on boot due to that. Also this "lost entropy" thing has long been a bane of VM servers, which could consume vast amounts of it. I think this changed fairly recently. And lots of things have USB ports these days, including things like commercial wifi access points, routers, switches, etc. Some of those have internal ones.
dragontamer 4y ago
All Intel and AMD chips come with a hardware RNG today: the RDRAND and RDSEED instructions. RDRAND is kinda-sorta like /dev/urandom, while RDSEED is /dev/random with stronger entropy guarantees. Linux didn't want to "trust" this hardware, for whatever reason. I guess there was that one time an AMD bug in the instruction returned all-zeros (or something similar). But as "long as the instruction is properly working", it is... well... working, lol. But its not like its really possible to test if its working correctly. -------- From that perspective, a hardware RNG needs to be "large" and "discrete" enough for humans to easily test and prove that its working, to create trust. Otherwise, hardware and/or firmware bugs could lead to a security problem. EDIT: if you are at a mass produced but don't verify kinda person, then you might as well use RDSEED instructions to get her entropy. Intel/AMD probably are good enough to prevent firmware / hardware bugs. I know that VMs also have an issue here: whether or not to make RDSEED deterministic/predictable or not. Should the future RDSEED instructions be saved in a VM snapshot?
- jnwatson 4y ago
  You can (and are required to in certain environments) test for basic failures in your hardware RNG. The AMD bug was bad not because of the bug, but because it was obvious they had no built-in-test functionality.
- garaetjjte 4y ago
  >RDRAND is kinda-sorta like /dev/urandom, while RDSEED is /dev/random with stronger entropy guarantees. /dev/urandom and /dev/random is almost the same nowadays, the only difference is that random will block after boot until enough entropy is collected, but it never "runs out" of entropy anymore.

anfractuosity 4y ago

Has anyone seen any open hardware optical RNGs out of interest, for high bandwidth generation?

jnwatson 4y ago
There isn't a good reason for high bandwidth hardware RNG. You seed a PRNG with a slow HW RNG and you're good to go.
- genewitch 4y ago
  this is one school of thought, for sure.
- nullc 4y ago
  A reason is if you're using a scheme that has information theoretic security, rather than computational, when instantiated with a TRNG. Hopefully adequately built computational security is sufficient for any purpose, but this is a certificational difference-- hopefully not one in practice but potentially one in the kind of guarantees that you can give. (E.g. you can't prove that someone doesn't secretly know how to invert a HMAC-DRBG to get its state given a large chunk of its output) It would be pretty foolish to use a IT security scheme just to destroy the property by using a DRBG to source its random numbers. That said, since TRNGs are mostly interesting to snake oil drinkers there is good reason to expect most TRNG to be poorly constructed. (E.g. it's really common to see then dropping output based on a NIST SP 800-22, thus technically resulting in a biased output).
- anfractuosity 4y ago
  I'm mostly interested in optical HWRNGs from a curiosity about the single photon emitter, was just skimming a paper which seemed to indicate you can make one from a std. LED, which seemed very cool to me.

tonetheman 4y ago

This was mentioned somewhere on the site and it is abandoned but it seems like a great way to get some entropy also. From a software radio dongle. https://github.com/pwarren/rtl-entropy https://github.com/pwarren/rtl-entropy

genewitch 4y ago
I've used randio and rtl-entropy, and they work okay, but there's some - possibly legitimate - concerns that even a shielded device can be made to output arbitrary [enough] bits from a concentrated attack, should an adversary know you're using that for entropy. As far as generation, old webcams sealed inside of coffee cans painted as dark as possible on the inside, and then sealed to ensure no light gets in, can be used to generate bits pretty quickly. I haven't had time or inclination to mess with avalanching diodes/transistors/resistors to verify the randomness and immunity to environment, but i have used the above methods to test their entropy, and used it to generate One Time Pads. As per my HN profile, i used to be very into entropy research and methods; but lately my home - and homestead - life take up most of my time. and RDRAND et al use thermals from the dark silicon to generate ~1mhz of entropy (as of 2018,) which should be sufficient for practically any normal usage of entropy. A hardware entropy / RNG should only be needed if you are running something like a "lottery", you still need a verifiable "whitener", and you never touch "CSRNG" or "PRNG" anywhere.
- tonetheman 4y ago
  Your comment is super interesting. I did not know you could get entropy from a dark web cam. Super cool stuff!
  - genewitch 4y ago
    as Joachim mentioned; and as i thought i replied already - all sensors have enough noise to be entropy sources. If you can quiesce a sensor - by putting it in a chamber that reduces whatever it senses, or otherwise reducing the input, you can grab "noise". MEMS sensors are notorious for being "noisy", and should always be looked at for cheap entropy sources. Followed by webcams in black chambers, webcams with a single photon source in a reflective chamber, anything that can pick up any RF whatsoever (including ADCs with signal and a resistor or inductor to ground), and so on up to thermals, Geiger detectors, avalanche silicon circuits, and beyond.

m463 4y ago

There's also the infinite noise rng: https://www.crowdsupply.com/leetronics/infinite-noise-trng https://www.crowdsupply.com/leetronics/infinite-noise-trng

magicalhippo 4y ago
One key difference (at least for some) is that the Infinite Noise project uses a completely hardware-defined USB chip[1], which has been decapped. Thus you could in theory buy a batch, decap a random selection and visually inspect to verify that it matches the reference. The OneRNG uses a more regular SoC, which is theoretically susceptible to supply chain issues like fakes or deliberate tampering. To their credit, they do mention this: There is one complex chip on the OneRNG which cannot be verified by eye. The CC2531 SoC (from Texas Instruments) is small, and it is theoretically possible that the chip fitted to your device has been tampered with or even been outright substituted for an alternative before you received your device. [1]: https://www.crowdsupply.com/13-37/infinite-noise-trng/updates/parallel-modular-entropy-multiplication-and-the-usb-chip https://www.crowdsupply.com/13-37/infinite-noise-trng/update...

sbf501 4y ago

I don't see a FIPS certification for it? I mean, at least show us some NIST 800-22 results. We already have a DRBG RFC to account for poor-entropy systems that has considerable research behind it. This seems pointless.

Forbo 4y ago

I've got an FST-01 that I've been meaning to set up with NeuG as a hobby project. Not sure if it would be worthwhile or if I would be better served spending my time on something else.

ur-whale 4y ago

> primarily from an avalanche diode circuit, Unfortunately, these diodes in avalanche mode degrade over time and it is unclear how stable the quality of the entropy derived from this analog circuit is over long periods of time.

ur-whale 4y ago

One of my favorite technique for building a hardware RNG uses a cheapo FPGA circuit (something like this: https://www.aliexpress.com/item/32241350256.html?spm=a2g0o.productlist.0.0.47da52e2vIZCiT&algo_pvid=da8182e6-75f6-4f81-96b7-3c5ab357b0b8&algo_exp_id=da8182e6-75f6-4f81-96b7-3c5ab357b0b8-17&pdp_ext_f=%7B%22sku_id%22%3A%2256011206743%22%7D&pdp_npi=2%40dis%21EUR%2154.2%2137.95%21%21%214.67%21%21%40210318b916659522513785493eca33%2156011206743%21sea&curPageLogUid=HOTcKVGFGvph https://www.aliexpress.com/item/32241350256.html?spm=a2g0o.p...) with a bunch of free-running high-frequency oscillators called ring oscillators (basically loops of NOT gates, which have a lot of phase noise, especially if they run hot) that are sampled at constant frequency. The entropy isn't very "clean" (lots of auto-correlation), but it's unpredictable enough to seed a crypto hard RNG which can also be built into the FPGA and operate at very high speed. It's also an increasing PITA to convince synthesis tools to actually emit ring oscillators, which they consider to be a design bug (which they almost always are, except in this specific case), but it's still possible. [EDIT]: a quick search on github yields: https://github.com/stnolting/neoTRNG https://github.com/stnolting/neoTRNG https://github.com/Netnod/rosc_entropy https://github.com/Netnod/rosc_entropy

JoachimS 4y ago
I was going to say that this is what we used as one of two entropy sources [0] in the Cryptech HSM. But the second link there is the fork of the Cryptech rosc entropy source we did for the FPGA based NTS server. ;-) The TRNG in the Tillitis Key 1 (TK1) we released a couple of weeks ago contain a version of the rosc entropy source. But I have now included a VN-decorrelator. And the actual oscillators are much simpler, cleaner. [0] The other entropy source in cryptech is an avalanche noise source outside of the FPGA. Both sources can be found here: https://git.cryptech.is/core/rng/avalanche_entropy/ https://git.cryptech.is/core/rng/avalanche_entropy/ https://git.cryptech.is/core/rng/rosc_entropy/ https://git.cryptech.is/core/rng/rosc_entropy/ The complete TRNG samples both sources (round robin) and creates a seed using SHA-512, with previous seed a part of the input. The seed is then used to initialize ChaCha20 as CSPRNG: https://git.cryptech.is/core/rng/trng/ https://git.cryptech.is/core/rng/trng/
- ur-whale 4y ago

nimbius 4y ago

for those interested, you can do the same thing with a $20 usb dtv receiver and rngd using the rtl-sdr entropy project http://blog.cros13.net/2014/08/cheap-entropy-using-your-rtl-sdr-as.html?m=1 http://blog.cros13.net/2014/08/cheap-entropy-using-your-rtl-...

Geee 4y ago

The chip itself isn't verifiable, like the document says. It's possible that there's a backdoor. It's not likely, but it's not verifiable and you'll have to trust it.

JoachimS 4y ago

Given a suitable app, the Tillitis Key 1 works as a RNG. I have written a first version, and will release one in the public app repository in a week or so. https://github.com/tillitis/tillitis-key1 https://github.com/tillitis/tillitis-key1 https://github.com/tillitis/tillitis-key1-apps https://github.com/tillitis/tillitis-key1-apps