5 ms·

Could you expand on that? I understand the idea from the quote, but I don't understand why you left your job. Was it because you assessed there wasn't a need fo

by zeven7 2y ago

Could you expand on that? I understand the idea from the quote, but I don't understand why you left your job. Was it because you assessed there wasn't a need for high throughput quantum random numbers? Or because you thought it was wasteful? Or something else? The concern I would have with relying too much on a source key to derive other keys from would be if one of the keys is leaked, the others would also be exposed. I don't have an application in mind, but assume some could exist where that would be a concern. Maybe you could respond to that concern. I don't know what use cases your company would have been targeting.

hannob 2y ago
His point was that he was working on a product that solves no actual problem. Quantum RNGs are gimmicks that are sold as a solution to a security problem. But they don't solve any security problem. There are real security problems with RNGs, but none of them is solved by a Quantum RNG. They usually come down to implementation errors or not using a secure RNG.
- GTP 2y ago
  > not using a secure RNG. Wouldn't a quantum RNG solve this issue? I'm aware that there are non-quantum ways to fix this problem, but in my mind quantum is one of the possible solutions, albeit one of the most expensives.
  - hannob 2y ago
    No, a Quantum RNG does not solve the issue that people use an API for insecure random numbers when they should use one for secure random numbers. Every OS already has a secure RNG API. That's a solved problem.
- kurikuri 2y ago
  No, they aren’t gimmicks. The advantage of a quantum-based entropy sources are that they are often much faster than other hardware based entropy source. They are called ‘quantum’ because they exploit randomness present in particle behaviors described by quantum physics (photon behavior on a beam splitter, etc.). Even ring oscillator based random number generators have quantum effects that contribute to its jitter (think shot noise, as an example), but the analysis of its randomness didn’t require quantum physics to describe it. Quantum RNGs don’t exploit some ‘quantum computing’ property and are strictly limited to a different type of noise from the usual physical noise sources (ring oscillators, phase locked loops, etc.).
  - commandersaki 2y ago
    My point is that you don't need an extravagant Quantum source for randomness, and you definitely don't need high throughput. It's really a solution looking for a problem. Also, I've seen numerous people working in the Quantum space claim that metastability is a quantum effect of ring oscillators, but very doubtful and the literature around it never mentions the q-word.
    - kurikuri 2y ago
      Most people do not need high throughput entropy sources, sure. But the people who do pay quite a bit for that functionality. I also haven’t seen any oft-referred literature describing metastability do so using a quantum-physics context. The metastability itself is a product of quantum behavior but has been described well enough without needing it. Depending on what you’re exploiting randomness-wise (like the metastability or the oscillation period length), the type of physical description you use to analyze the noise source changes quite a bit. For most ring oscillator work, I prefer to look at the work near the 2000’s by Ali Hajimiri, none of which is in terms of quantum anything.
  - hannob 2y ago
    > The advantage of a quantum-based entropy sources are that they are often much > faster than other hardware based entropy source. What kind of problem is solved by a fast, hardware-based entropy source? You only need a couple of bytes of entropy to initialize your RNG.
    - kurikuri 2y ago
      Keeping the DRBG’s state (seed material) secure for the duration of its use is the problem. If this state is leaked, depending on the type of leak, then anything generated from that DRBG is now not protected. Even worse, you may not even know that this the case and continue to use the DRBG assuming that it is safe. If state management is was not an issue, I’d agree with you, but the fact that vulnerabilities tend to appear in very unexpected places (side channels, speculative execution, etc.), makes this problem difficult. A sidestep is to simply have fresh entropy.
commandersaki 2y ago
hannob aptly explained why I left my job, because Quantum RNG is a gimmick and doesn't solve any real problems. But to expand on that, it was heavily marketed with the idea that somehow we're living in a "entropy starved" world. We do a pretty good job of gathering entropy today from various sources such as mixing unique identifiers of hardware, CPU jitter, interrupt timing, RDRAND (which is a similar design to metastability of ring oscillators), etc. So the remark if you haven't managed to generate one secure 256-bit key then you have much bigger problems resonated heavily with me, and I realised there just isn't a need for gigabit speed TRNGs and the Quantum marketing is just scare tactics which my employer employed. Also no crypto library or application is going to modify its entropy source to get its randomness from a TRNG device directly when it already has access to a high quality RNG via OS APIs/crypto libraries (for a good list of these check out https://randombytes.cr.yp.to/ https://randombytes.cr.yp.to/). The concern I would have with relying too much on a source key to derive other keys from would be if one of the keys is leaked, the others would also be exposed A modern RNG would implement fast key erasure which is what Jason Donenfeld did with random device in Linux. See https://blog.cr.yp.to/20170723-random.html https://blog.cr.yp.to/20170723-random.html and https://www.zx2c4.com/projects/linux-rng-5.17-5.18/inside-linux-kernel-rng-presentation-sept-13-2022.pdf https://www.zx2c4.com/projects/linux-rng-5.17-5.18/inside-li... .

by zeven7 2y ago

hannob 2y ago

His point was that he was working on a product that solves no actual problem. Quantum RNGs are gimmicks that are sold as a solution to a security problem. But they don't solve any security problem. There are real security problems with RNGs, but none of them is solved by a Quantum RNG. They usually come down to implementation errors or not using a secure RNG.

GTP 2y ago
> not using a secure RNG. Wouldn't a quantum RNG solve this issue? I'm aware that there are non-quantum ways to fix this problem, but in my mind quantum is one of the possible solutions, albeit one of the most expensives.
- hannob 2y ago
  No, a Quantum RNG does not solve the issue that people use an API for insecure random numbers when they should use one for secure random numbers. Every OS already has a secure RNG API. That's a solved problem.
kurikuri 2y ago
No, they aren’t gimmicks. The advantage of a quantum-based entropy sources are that they are often much faster than other hardware based entropy source. They are called ‘quantum’ because they exploit randomness present in particle behaviors described by quantum physics (photon behavior on a beam splitter, etc.). Even ring oscillator based random number generators have quantum effects that contribute to its jitter (think shot noise, as an example), but the analysis of its randomness didn’t require quantum physics to describe it. Quantum RNGs don’t exploit some ‘quantum computing’ property and are strictly limited to a different type of noise from the usual physical noise sources (ring oscillators, phase locked loops, etc.).
- commandersaki 2y ago
  My point is that you don't need an extravagant Quantum source for randomness, and you definitely don't need high throughput. It's really a solution looking for a problem. Also, I've seen numerous people working in the Quantum space claim that metastability is a quantum effect of ring oscillators, but very doubtful and the literature around it never mentions the q-word.
  - kurikuri 2y ago
    Most people do not need high throughput entropy sources, sure. But the people who do pay quite a bit for that functionality. I also haven’t seen any oft-referred literature describing metastability do so using a quantum-physics context. The metastability itself is a product of quantum behavior but has been described well enough without needing it. Depending on what you’re exploiting randomness-wise (like the metastability or the oscillation period length), the type of physical description you use to analyze the noise source changes quite a bit. For most ring oscillator work, I prefer to look at the work near the 2000’s by Ali Hajimiri, none of which is in terms of quantum anything.
- hannob 2y ago
  > The advantage of a quantum-based entropy sources are that they are often much > faster than other hardware based entropy source. What kind of problem is solved by a fast, hardware-based entropy source? You only need a couple of bytes of entropy to initialize your RNG.
  - kurikuri 2y ago
    Keeping the DRBG’s state (seed material) secure for the duration of its use is the problem. If this state is leaked, depending on the type of leak, then anything generated from that DRBG is now not protected. Even worse, you may not even know that this the case and continue to use the DRBG assuming that it is safe. If state management is was not an issue, I’d agree with you, but the fact that vulnerabilities tend to appear in very unexpected places (side channels, speculative execution, etc.), makes this problem difficult. A sidestep is to simply have fresh entropy.

commandersaki 2y ago

hannob aptly explained why I left my job, because Quantum RNG is a gimmick and doesn't solve any real problems. But to expand on that, it was heavily marketed with the idea that somehow we're living in a "entropy starved" world. We do a pretty good job of gathering entropy today from various sources such as mixing unique identifiers of hardware, CPU jitter, interrupt timing, RDRAND (which is a similar design to metastability of ring oscillators), etc. So the remark if you haven't managed to generate one secure 256-bit key then you have much bigger problems resonated heavily with me, and I realised there just isn't a need for gigabit speed TRNGs and the Quantum marketing is just scare tactics which my employer employed. Also no crypto library or application is going to modify its entropy source to get its randomness from a TRNG device directly when it already has access to a high quality RNG via OS APIs/crypto libraries (for a good list of these check out https://randombytes.cr.yp.to/ https://randombytes.cr.yp.to/). The concern I would have with relying too much on a source key to derive other keys from would be if one of the keys is leaked, the others would also be exposed A modern RNG would implement fast key erasure which is what Jason Donenfeld did with random device in Linux. See https://blog.cr.yp.to/20170723-random.html https://blog.cr.yp.to/20170723-random.html and https://www.zx2c4.com/projects/linux-rng-5.17-5.18/inside-linux-kernel-rng-presentation-sept-13-2022.pdf https://www.zx2c4.com/projects/linux-rng-5.17-5.18/inside-li... .