4 ms·

I was under the impression there were "true" random number generators that used input from external random sources like ambient noise or mouse movements etc.

hga 12y ago
Correct. Thermal and quantum effects are popular in my experience of buying a couple of these devices in the '90s and now this decade, radioactive decay works as well, and then there are hacks like the fine details of how you use your mouse that I gather are very nice ... but totally fail for VMs (that really need to be fed true randomness from a server). Intel started shipping a random number source based on one with Ivy Bridge processors: http://en.wikipedia.org/wiki/RdRand http://en.wikipedia.org/wiki/RdRand But it's hard/expensive to get really high rates of true randomness this way (I recently read there are needs that go as high as a GiB/second), so most of these true sources of randomness are used to seed high quality PRNG algorithmic generators, and that's true for Intel's system. Although of course we're not entirely trusting Intel....
- billmalarky 12y ago
  Would it at all be possible to serve "randomness" at those levels as a service?
  - hga 12y ago
    Which levels? You can certainly serve true randomness sufficient to seed cryptographically secure PRNG generators. Right now all my VMs and systems at home are served that from a good source of true randomness. I've seen such sources on the net, e.g. http://www.random.org/ http://www.random.org/ The big issue is trust, especially when it's relatively easy and cheap to provide true randomness locally. And as mentioned, a standard desktop can generate its own randomness through things like mouse movements, which is very cheap. The major use case would be VMs, and I suspect few who run them would trust an external source, unless their cloud vendor offered it as a service. I could see vendors being reluctant to do so for liability reasons.

hga 12y ago

Correct. Thermal and quantum effects are popular in my experience of buying a couple of these devices in the '90s and now this decade, radioactive decay works as well, and then there are hacks like the fine details of how you use your mouse that I gather are very nice ... but totally fail for VMs (that really need to be fed true randomness from a server). Intel started shipping a random number source based on one with Ivy Bridge processors: http://en.wikipedia.org/wiki/RdRand http://en.wikipedia.org/wiki/RdRand But it's hard/expensive to get really high rates of true randomness this way (I recently read there are needs that go as high as a GiB/second), so most of these true sources of randomness are used to seed high quality PRNG algorithmic generators, and that's true for Intel's system. Although of course we're not entirely trusting Intel....

billmalarky 12y ago
Would it at all be possible to serve "randomness" at those levels as a service?
- hga 12y ago
  Which levels? You can certainly serve true randomness sufficient to seed cryptographically secure PRNG generators. Right now all my VMs and systems at home are served that from a good source of true randomness. I've seen such sources on the net, e.g. http://www.random.org/ http://www.random.org/ The big issue is trust, especially when it's relatively easy and cheap to provide true randomness locally. And as mentioned, a standard desktop can generate its own randomness through things like mouse movements, which is very cheap. The major use case would be VMs, and I suspect few who run them would trust an external source, unless their cloud vendor offered it as a service. I could see vendors being reluctant to do so for liability reasons.