4 ms·

> "People talk about using radioactive sources, and that probably gives better randomness, but a more practical approach is to use noise from a reverse-biased P

> "People talk about using radioactive sources, and that probably gives better randomness, but a more practical approach is to use noise from a reverse-biased PN junction." Americium-241, the active component in smoke directors, has a half-life of 432 years, so it should be possible to build inexpensive hardware devices capable of generating a stream of true random numbers that probably could be designed meet all the statistical requirements needed for cryptographic seeds. It's surprising that something like this isn't available; it could be a standard on-board component or packaged into a usb device.

brudgers 3y ago
It's surprising that something like this isn't available Cryptography is a munition (in the US). https://en.wikipedia.org/wiki/Export_of_cryptography_from_the_United_States#Current_status https://en.wikipedia.org/wiki/Export_of_cryptography_from_th... That might explain the non-ubiquity of convenient random number generator hardware under a hypothesis that widespread use would make signals intelligence much more difficult for three letter agencies. YMMV.
- tptacek 3y ago
  It would do no such thing. Commodity computing devices are plenty capable of generating key material without specialized circuitry.
  - brudgers 3y ago
    The military-industrial complex provides solutions suited for the military-industrial complex’s interests. The three letter agencies have repeatedly expressed an interest in backdoored encryption over the past four decades. Your inkjet printer encodes thumbprints. Your laser printer won’t replicate currency. They are still good enough for ordinary use cases. I don’t think cryptography is any different. It’s fine by me if you disagree. My view is based on the opinion that failure to subvert cryptography would be professional incompetence and the three letter agencies are full of competent professionals with deep motivations like patriotism and better funded than everyone else. YMMV.
    - tptacek 3y ago
      I'm fine with your beliefs about the trustworthiness of authorities, the IC, whatever. My problem with attempts to extend those beliefs axiomatically into computer science, where they don't hold. The IC's desire to subvert random number generation isn't a point I'd argue. Let's just stipulate that it's true. The process you're describing of accomplishing that, of preventing the distribution of random number generating circuits, doesn't work. That's not how random bit generation works in modern cryptosystems.
      - brudgers 3y ago
        https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_ReflectionsonTrustingTrust.pdf https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_Ref... For me, it is not a question of computer science. It is a matter of practical engineering for manufacturing and distribution in a the context of reified political interests. Cryptography is a munition. All the technical details of current common methods are shaped by that fact or alternatively the military-industrial complex has given up its interest in controlling it. I never saw a press conference announcing the latter. If I saw one, that’s when I would put on my tinfoil hat…maybe Devo style flowerpot?
    - eternityforest 3y ago
      That's why Linux doesn't use the HW randomness by itself, it gathers entropy from lots of sources like peripheral timings, and hashes it all. If the crypto algorithms are broken it doesn't matter if the RNG is good, without good crypto there's not much you can do with randomness except OTP.
loeg 3y ago
No one needs a random source that meets statistical properties unfiltered; you just need something good enough that can be filtered, compressed, and distilled into a few unpredictable bits. 256-512 high quality bits are enough to seed everything else for an indefinite period of time. If your random source only has ~0.1 bit-per-byte of entropy but can produce 30,000 biased bits quickly, that's enough to seed the system. https://blog.cr.yp.to/20170723-random.html https://blog.cr.yp.to/20170723-random.html
dfox 3y ago
Many contemporary computing platforms have some kind of HW RNG built into them, these are often regarded with some kind of skepticism as they are not really auditable. The larger issue is that these are not really needed, any device that does something useful (ie. interacts with the outside world) and retains some kind of non-volatile internal state is perfectly capable of generating cryptographic randomness purely in software.
eternityforest 3y ago
Yes but then you would have to own something that contains Americium. We put up with it in smoke detectors because house fires are more scary than the radiation, but I don't see why you'd want even the tiny extra risk of the thing getting somehow broken or burnt in an illegal recycling fire or something, just for random numbers. Maybe you could do a safe version that used a banana as the radioactive element, it would make enough entropy to seed a RNG.

brudgers 3y ago

It's surprising that something like this isn't available Cryptography is a munition (in the US). https://en.wikipedia.org/wiki/Export_of_cryptography_from_the_United_States#Current_status https://en.wikipedia.org/wiki/Export_of_cryptography_from_th... That might explain the non-ubiquity of convenient random number generator hardware under a hypothesis that widespread use would make signals intelligence much more difficult for three letter agencies. YMMV.

tptacek 3y ago
It would do no such thing. Commodity computing devices are plenty capable of generating key material without specialized circuitry.
- brudgers 3y ago
  The military-industrial complex provides solutions suited for the military-industrial complex’s interests. The three letter agencies have repeatedly expressed an interest in backdoored encryption over the past four decades. Your inkjet printer encodes thumbprints. Your laser printer won’t replicate currency. They are still good enough for ordinary use cases. I don’t think cryptography is any different. It’s fine by me if you disagree. My view is based on the opinion that failure to subvert cryptography would be professional incompetence and the three letter agencies are full of competent professionals with deep motivations like patriotism and better funded than everyone else. YMMV.
  - tptacek 3y ago
    I'm fine with your beliefs about the trustworthiness of authorities, the IC, whatever. My problem with attempts to extend those beliefs axiomatically into computer science, where they don't hold. The IC's desire to subvert random number generation isn't a point I'd argue. Let's just stipulate that it's true. The process you're describing of accomplishing that, of preventing the distribution of random number generating circuits, doesn't work. That's not how random bit generation works in modern cryptosystems.
    - brudgers 3y ago
      https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_ReflectionsonTrustingTrust.pdf https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_Ref... For me, it is not a question of computer science. It is a matter of practical engineering for manufacturing and distribution in a the context of reified political interests. Cryptography is a munition. All the technical details of current common methods are shaped by that fact or alternatively the military-industrial complex has given up its interest in controlling it. I never saw a press conference announcing the latter. If I saw one, that’s when I would put on my tinfoil hat…maybe Devo style flowerpot?
  - eternityforest 3y ago
    That's why Linux doesn't use the HW randomness by itself, it gathers entropy from lots of sources like peripheral timings, and hashes it all. If the crypto algorithms are broken it doesn't matter if the RNG is good, without good crypto there's not much you can do with randomness except OTP.

loeg 3y ago

No one needs a random source that meets statistical properties unfiltered; you just need something good enough that can be filtered, compressed, and distilled into a few unpredictable bits. 256-512 high quality bits are enough to seed everything else for an indefinite period of time. If your random source only has ~0.1 bit-per-byte of entropy but can produce 30,000 biased bits quickly, that's enough to seed the system. https://blog.cr.yp.to/20170723-random.html https://blog.cr.yp.to/20170723-random.html

dfox 3y ago

Many contemporary computing platforms have some kind of HW RNG built into them, these are often regarded with some kind of skepticism as they are not really auditable. The larger issue is that these are not really needed, any device that does something useful (ie. interacts with the outside world) and retains some kind of non-volatile internal state is perfectly capable of generating cryptographic randomness purely in software.

eternityforest 3y ago

Yes but then you would have to own something that contains Americium. We put up with it in smoke detectors because house fires are more scary than the radiation, but I don't see why you'd want even the tiny extra risk of the thing getting somehow broken or burnt in an illegal recycling fire or something, just for random numbers. Maybe you could do a safe version that used a banana as the radioactive element, it would make enough entropy to seed a RNG.