9 ms·

OneRNG – Open Hardware Random Number Generator

171 points by kim_rutherford 12y ago

edwintorok 12y ago
How does it compare to the NeuG? Which entropy source is better? http://www.gniibe.org/memo/development/gnuk/rng/neug.html http://www.gniibe.org/memo/development/gnuk/rng/neug.html
- WaywardGeek 12y ago
  Note: I've only glanced at NeuG, so this is an over-simplified repy. Neug relies on a few different A/D inputs as a noise source. The resolution of the A/Ds is only 12 bits, meaning it is not capable of reliably measuring thermal noise in the system. In any case, it does not seem to be trying to measure voltage on a high impedance node. Therefore the data passed will be power supply noise and other sources of external influence. These potentially can be influenced by an attacker, maybe even remotely. I do like this architecture for a TRNG, and I like that it is open, but I do not believe the creator of NeuG has put nearly the TRNG know-how into this design as OneRNG. Personally, I'm looking forward to signing up on the Kickstarter for OneRNG when it happens.
Animats 12y ago
That's awfully complicated for a hardware RNG. A channel-hopping receiver? The classic solution is a radiation source, which quantum mechanics says is random. http://www.fourmilab.ch/hotbits/hardware3.html http://www.fourmilab.ch/hotbits/hardware3.html
- crististm 12y ago
  What part is in fact that complicated?
- tribaal 12y ago
  It's much much easier to build from cheap parts than something with a radiation source.
- lgeek 12y ago
  Maybe it is more complicated as a concept, but the implementation is much more simple. They're using a MCU with integrated radio, it's almost free to add the RF source to the base system only using the avalanche diode. A HV geiger tube and embedding a radiation source would be much more complicated / expensive to build, especially on small scale.
- stormbrew 12y ago
  I'm not sure about you, but I don't really think I'd want to keep even the minor sources of radiation described on that page in my pocket.
- ganzuul 12y ago
  From the same site, quantitative analysis: "The chi-square test is the most commonly used test for the randomness of data, and is extremely sensitive to errors in pseudorandom sequence generators. The chi-square distribution is calculated for the stream of bytes in the file and expressed as an absolute number and a percentage which indicates how frequently a truly random sequence would exceed the value calculated. We interpret the percentage as the degree to which the sequence tested is suspected of being non-random. If the percentage is greater than 99% or less than 1%, the sequence is almost certainly not random. If the percentage is between 99% and 95% or between 1% and 5%, the sequence is suspect. Percentages between 90% and 95% and 5% and 10% indicate the sequence is “almost suspect”. Note that our JPEG file, while very dense in information, is far from random as revealed by the chi-square test. Applying this test to the output of various pseudorandom sequence generators is interesting. The low-order 8 bits returned by the standard Unix rand() function, for example, yields: Chi square distribution for 500000 samples is 0.01, and randomly would exceed this value more than 99.99 percent of the times. While an improved generator [Park & Miller] reports: Chi square distribution for 500000 samples is 212.53, and randomly would exceed this value 97.53 percent of the times. Thus, the standard Unix generator (or at least the low-order bytes it returns) is unacceptably non-random, while the improved generator is much better but still sufficiently non-random to cause concern for demanding applications. Contrast both of these software generators with the chi-square result of a genuine random sequence created by timing radioactive decay events. Chi square distribution for 500000 samples is 249.51, and randomly would exceed this value 40.98 percent of the times. " - http://www.fourmilab.ch/random/ http://www.fourmilab.ch/random/
- WaywardGeek 12y ago
  The channel hoping is just a bit of software. It costs $0.00 in additional hardware. Software complexity is a big deal in a TRNG. The KISS rule applies big-time here. The more complex the software, the more likely it is a significant flaw will be found and exploited. It remains unclear to me whether there should even be a microcontroller on a USB TRNG. Without one, we can eliminate the complexity from the USB key itself, but we have to move the whitening and health monitoring to the driver. It is unclear to me if making the driver more complex opens it up to enough additional attacks that the system is less secure overall.
  - deleted 12y ago
    [deleted]
tribaal 12y ago
Well, I'm happy to see that for once, they understand that the single most important thing is that it's verifiable. So many crypto-related systems ask you to trust the provider implicitly it's not even funny. I don't care who you are, if I can't look at the source (all the way down) of your product and build it myself, it's not going to make the cut as a "secure" system. You can provide additional guarantees and proofs, but showing me the source is item number 0. Sure, it's not perfect, but it's much closer to perfect than any alternatives.
- gioele 12y ago
  > You can provide additional guarantees and proofs, but showing me the source is item number 0. And item number 0.5 is allowing me to build the source and upload it to a pristine EEPROM chip.
  - Taniwha 12y ago
    as part of our kickstarter we'll be offering programmers as an added reward - you can build the image from source and program your device - and we hope you do and share the results with the world You can't program it over the USB (although we could) we consider that that would be a security problem - and given recent security issues with programmable USB devices ....
    - notthetup 12y ago
      One of the kickstarter rewards could be the ICSP programmer HW (i'm guessing that's what you're using) so who ever wants to program it could do it.
      - Taniwha 12y ago
        we use a home-grown programmer - it's cheap but the bed-of-nails cable costs as much as the board - we wont be making any money on them
  - tribaal 12y ago
zaroth 12y ago
A good CS-PRNG can take a modest amount of entropy and store it in a way (internal state) that you trust it can't be recovered by the attacker. From this they can generate a nearly endless supply of random output. That, as I understand it, is /dev/random vs. /dev/urandom/. So it's nice to have a good reliable source of entropy, but you can also consider how protected is the internal state, aka the place you stick that entropy? The better protected the CS-PRNG state, the less entropy you actually need. If you trust the CS-PRNG state, then hardware entropy sources won't matter much to you, because you just don't need that much entropy. When you start streaming entropy from many sources, it's probably to consistently update internal state over time because you don't fully trust that the state is secure. It should make no difference either way in the quality of the output (directly pulling entropy versus CS-PRNG output). Because the necessary amount of output to reverse-engineer state is almost infinite, the output of a properly implemented CS-PRNG is highly trusted. And they're really nice algorithms that have well reviewed implementations.
- raverbashing 12y ago
  Yeah, but you have a reliable source of entropy you don't need to get a lot of random numbers from your CSPRNG before reseeding.
gear54rus 12y ago
This seems sound. However, I'm in doubt about some of their points: > You can ask it to dump the current firmware to you It can dump the firmware but it can still execute something else than this (or in addition to) this firmware, can't it? > You can see all the components on the board The fact that I can see these tiny thingies doesn't do much good either? Can I, seeing them, tell what they do? No. Building one of these yourself seems to solve both problems. Not trying to undermine it or anything, just curious what others think of it.
- tribaal 12y ago
  The point is - you can verify it yourself. Without trusting anybody else. Dumping the firmware means you can ensure it's not been modified (presumably from when you uploaded it to the device yourself). Being able to inspect components means you can ensure it's still exactly as you built it. And if you haven't, you can visually check that it does what it says it does. If you're not technically competent to make this verification, you can ask somebody you trust and who is to do it for you.
  - gcommer 12y ago
    None of the images show the other side of the board, but unless every trace is visible, it will be difficult to non-destructively inspect. If its only a 2 layer board then this just means scratching off the white silkscreen, which wouldn't be too bad. If its more than 2 layers, you would have to have access to an X-ray machine.
    - Taniwha 12y ago
      it's a two layer board - no buried wires or vias - by design there are very few wires on the bottom layer, none under the noise source (we want to contain the noise) - you can see all the wires without removing the solder mask just by holding it in the right light we'll be publishing the layout files of course
  - joezydeco 12y ago
    How do we verify the internal microcode and switch fabric of the TI CC2531? IMO it seems like simply trusting the large block diagram that says "USB PHY" is a very weak point in the design.
bensn 12y ago
Suggestion for modification: Call it OpenRNG instead of OneRNG. In every second sentence i read the word open. Its obviously a main purpose.
- Taniwha 12y ago
  it's a sad pun, we're from NZ ....
  - bensn 12y ago
    oh... Now I get it. I take my suggestion back xD
  - notthetup 12y ago
    Just for that I will support you guys when it goes on kickstarter!
  - hughes 12y ago
    Still took me a minute - OneRNG -> "One Ring" LOTR reference
deutronium 12y ago
I'm curious why they chose to use an avalanche diode which doesn't generate quantum-random numbers, unlike a reverse-biased transistor. As far as I'm aware, this means you could effect the numbers, by varying temperature.
- Taniwha 12y ago
  actually it is a reverse biased transistor
  - deutronium 12y ago
    Aha cool, is the schematic online?
    - Taniwha 12y ago
      not yet, the actual RNG circuit is pretty standard - we'll put up the eagle files, along with the software sources, before we open the kickstarter
      - joeschmoe097845 12y ago
        If it's faster, could you put up a .png of the schematic? Also, the CC2531 looks like a QFN. Does it come in any hand-solderable packages?
        Taniwha 12y ago
        There's an almost current schematic on the "Theory of Operation" page: http://moonbaseotago.com/onerng/theory.html http://moonbaseotago.com/onerng/theory.html few (any?) chips that do 2.5GHz RF come in chips with traditional pins (too much inductance). QFNs are completely hand solderable (with hot air, solder paste and a pair of tweezers)
    - WaywardGeek 12y ago
      Every TRNG I've seen so far that uses "zener noise" is actually using the reverse breakdown voltage across the emitter-base junction of a cheap NPN transistor. This is a zener diode! The reason this form of zener is used is simply because the fab does not bother to put in any effort to reduce the avalanche noise. Noise like that makes zeners sold as zeners unpopular. Zener avalanche noise is unpredictable. How is an attacker supposed to guess when the next electron/hole pair is going to be created in the depletion region? Physically, what happens is the emitter-base junction is reverse biased, turning it into a diode that is blocking current from flowing from the emitter to the base. Every once in a while, due to thermal noise and likely quantum effects, an electron jumps up a valence level, creating an electron/hole pair in the middle of the reversed-biased N/P junction, where there is a strong electric field. This launches the electron in one direction and the hole in the other, where they gain speed rapidly. The electron has higher mobility and will gain enough speed to bang into other electron/hole pairs, creating an avalanche of electrons. There is no known way for anyone to guess when the next avalanche will occur, or how large it will be, so long as there is no outside signal controlling this effect. Implemented poorly, it can just put out power supply noise, and not true unpredictable entropy. Implemented well, it is a solid, reliable, cheap, and fast entropy source. It is absolutely critical that a zener noise TRNG has an open auditable design! As for "quantum" effects, I consider that marketing fluff. What we need is provable, reliable unpredictability, not some radioactive decay or photon emission. We don't need 100% unbiased unpredictability either, just a signal that cannot be predicted with much accuracy.
gioele 12y ago
> It even has a “tinfoil hat” to prevent RF interference Isn't this a problem in the US, being against the famous part 15 of the FCC rules: «Operation is subject to the following two conditions: (1) this device may not cause harmful interference, and (2) this device must accept any interference received, including interference that may cause undesired operation.»
- yen223 12y ago
  Huh, interesting. What's the rationale behind the 2nd condition?
  - DanBC 12y ago
    You have to design devices such that they don't fail when subject to interference. Put a mobile phone near a radio, send a text. You hear some burbling. Imagine that burbling is picked up by an insulin pump - you don't wan the pump to increase or decrease the dose based on that burble. See also analogue mobile phones which used to affect some gas station pump billing readouts. (CertInly some CB radios used to, whih caused bans, and phones are still banned in some stations today).
    - yen223 12y ago
      I think I misread that. It's supposed to mean "this device must be able to accept any interference received"?
- nightcracker 12y ago
  I'm fairly sure that the "accept" does not refer to "absorb without any countermeasures". It's a bit poorly worded. I think it refers to the fact that if your device fails due to interference below the legal limit it is your problem to fix, not the device that generated the interference.
  - dfox 12y ago
    I always assumed that it refers to the fact that interference under certain limit should not permanently destroy the device even when such interference may cause the device to behave erratically.
Taniwha 12y ago
Note: I'm Paul the designer Some background - this board is in late beta testing, we're going to kickstart it and release it (with papers scheduled at a couple of conferences) - it's hitting Hacker News a little early - but keep us in mind when we do finally release to the public - at the moment we haven't published the design - we'll be putting up both the firmware an hardware designs on GitHub when we think it's ready for the public (almost there) If you want some idea of the code and development system it's largely based on the dev system for out IoT project: http://www.moonbaseotago.com/cheaprf/ http://www.moonbaseotago.com/cheaprf/ Meanwhile I'm happy to answer questions
- dspillett 12y ago
  > we're going to kickstart it and release it Do you have any timescales for that yet, or are such decisions still heavily dependant on feedback from testing?
  - Taniwha 12y ago
    testing is good, no known roadblocks, we planning on a Decemberish time frame, we think we have a final firmware load at this point. We have a small pick-and-place machine/etc setup we'll do a small in-house run for those who want to pay a premium for early delivery and then possibly a slower run depending on demand.
    - PhantomGremlin 12y ago
      > We have a small pick-and-place machine/etc setup I've been in at the ground floor of a number of successful hardware startups. One of which had a number of pick and place machines, IR reflow ovens, and all sorts of related manufacturing equipment. So I'm quite familiar with the field. My very simple, very emphatic advice about a "pick-and-place" machine is: NO NO NO NO NO, a thousand times N0!!! Maybe it's something you have to do in NZ. But in some other parts of the world, if I blindfolded you and let you stumble around you would probably trip over a pick-and-place machine in about 5 minutes! They're everywhere. In other words, unless your primary purpose is to bootstrap yourself into being a contract manufacturer, you have absolutely no business owning your own pick-and-place machine. A design as simple as yours could be manufactured by almost anyone in the world. It's so simple that most of them could do it in their sleep. Just contract the manufacturing out and be done with it. Your quixotic effort at stuffing your own boards reminds me of the perhaps apocryphal story of, in the 1970's, WDC designing a chipset that was used in the DEC LSI-11 minicomputer.[1] They had a fab, and in one week they could make enough chips for DEC to sell minicomputers for a year. "Okay, the LSI-11 chips are done. Now WTF do we do with this fab for the other 51 weeks of the year???" Yeah, in the old days IC fabs were cheap enough that everyone and his brother owned one. And they had large fixed costs. And unless they were utilized around the clock they lost money. To a large extent stuff like pick-and-place machines are the same. Sure it's orders of magnitude cheaper. But still, maybe it takes you a week or two to build some of your boards. What do you do with your equipment for the other 50 weeks of the year? Is that the business you want to be in? Of course, if that is the business you want to be in, then OK. [1] http://en.wikipedia.org/wiki/Western_Digital#1970s http://en.wikipedia.org/wiki/Western_Digital#1970s
notthetup 12y ago
If the avalanche diode is the main/primary source of entropy why do we need the CC2531? The super paranoid part of me is worried about the 802.15.4 radio being used as a vector to taint the RNG. Shouldn't an HW RNG NOT have any secondary communication method built in? I am guessing you guys added that because that's the platform you're working with for your IOT project, but it just seems a little overkill to me. The diode data acquisition and the USB comms could be easily done using any Cortex-M0 type micro.
- Taniwha 12y ago
  I think that's a fair point, I agonized over it for quite a while - the cc2531 was the USB device/ and stack I was building with at the time. This is the main reason why by default the device disables the RF source, you have to go out of your way to enable it by editing an /etc .conf file - however it actually does make a slightly better random stream
  - WaywardGeek 12y ago
    Is it possible for this device to transmit over radio, or only receive? I certainly prefer only being able to receive, as transmitting seems like an attack vector. With the assumption that it only receives, I would strongly prefer that it be left on by default. Adding a second source to the CRC mixing can only improve entropy, even if the source is controlled by an attacker. Since the noise from the zener has no simple proof of it's entropy output rate, and it can vary over time, and because zener noise TRNGs have been known to be power-supply noise sensitive (not that your's is), having that second source gives me much more confidence in the device.
    - Taniwha 12y ago
      It could transmit, there is no transmit code in the firmware, in fact there's no real receive code, we turn on the receiver and sample the LSB of RF noise in the sampling DACs but don't enable any demodulation or framing. Turning both RNGs on only gets you a about half a bit/byte of extra entropy - but it is a great belt and braces sort of thing, makes it much harder to attack, especially since the sampling clock inside the device for both sources is not visible eternally Remember we don't use the output data directly, we mix it into the kernel's entropy pool (where it's whitened)
imaginenore 12y ago
Or you could just use a shitty cheap webcam and take the lower bits of each pixel (or one pixel of each 8x8 block if the compression is bad). The amount of randomness per second webcams generate is pretty insane, it's more than enough to feed the seed of a crypto PRNG function like Fortuna.
- WaywardGeek 12y ago
  There are plenty of decent sources of entropy, like webcams and sound cards. However, they all add parts we don't need, and they don't take any care to design with security in mind. Eventually, a good open hardware TRNG should be cheaper, more reliable, easier to use, and more secure than any of those solutions, IMO.
  - imaginenore 12y ago
    > they all add parts we don't need What are you worried about exactly? Space? There are really really tiny cameras for smartphones that are mass-produced, and they are very noisy, which is perfect.
malgorithms 12y ago
A question for the designers (Paul?) about verifiability. In the software world you can effectively choose from 2 levels of review. You can (1) review the source code of a project and convince yourself it's fine. Or (2) you can assume/hope that experts have done that, download the software, and just verify you have an identical copy of what everyone else is reviewing. (Ideally using signatures of the authors and reviewers.) Almost everyone who cares does step 2, assuming they do anything at all. Very few people are qualified or bother to review source code, but everyone who performs step 2 can feel pretty safe, as long as a release is big enough that it's getting reviewed by experts. So, what's the hardware equivalent? If I'm not capable of reviewing the schema of this hardware, but someone I trust says "this is great", how do I at least know the one I bought is identical to the one she/he bought (or built) and reviewed? How do I verify the components? This seems like a difficult problem.
- robzyb 12y ago
  You run your "verified" software on hardware, right? How do you know the hardware is verified?
  - Taniwha 12y ago
    we publish the hardware design - in reality we have to run it on someone's chip, we've picked one that includes among other things AES, we just don't use that stuff, at some point we have to trust the CPU, and we use a CRC32 engine for minor whitening and stirring of our internal entropy pool - but crc32 is easy to verify (while AES is not) more importantly we've chosen a platform that we think is unlikely to have already subverted by 3 letter agencies
- tribaal 12y ago
  I think the idea is that the components are simple enough in the case that it can be reviewed visually by inspecting the circuit board and comparing it to a signed/verified reference. The last bit that is missing then is the chip's firmware, but apparently it is possible to get a dump of the firmware, so you can at least ensure it is what you expect. It will be a pretty interesting problem for cases. How can you both make a case that is practical and lets you inspect components? Maybe encasing the circuit board in transparent resin would work, but then you can't reprogram it anymore (which might be a feature). EDIT: Oh, that username rang a bell. Hi Chris :) Keybase.io FTW!
robomartin 12y ago
Back about 25 years ago I wanted to build a PC card to generate better random numbers. The idea I had at the time was to build in a set of four or five FM/AM radio receivers into this card and have them hop ratio stations constantly at, well, random intervals. Then I'd use the digitized audio signals in some combination to feed a random number generator. I thought it was a good idea at the time. Well, I didn't have enough experience yet to know just how much I didn't know. Never built it.
lifeformed 12y ago
Total layman question here, but how does an avalanche diode work?
PhantomGremlin 12y ago
If this gadget sells for under $50 (which it certainly should) I might consider buying one, just for the fun of it. But I haven't seen anyone here mention ID Quantique, one of the companies that the "big boys" use for random numbers. They're in Switzerland: http://idquantique.com/ http://idquantique.com/ Admittedly not open hardware, but FWIW they claim: QUANTIS has been evaluated and certified by the Swiss Federal Office of Metrology (also known as METAS), the Swiss national organization in charge of measurement science, testing and compliance. It confirmed that the quality of its random output complies with the highest requirements. The minor detail about buying from ID Quantique is that their cheapest USB product sells for about 990 euros, or about $1250.[1] I know it's apples and oranges, but anyone interested in this product should at least be aware of some alternatives. [1] http://idquantique.com/component/content/article.html?id=83 http://idquantique.com/component/content/article.html?id=83
malandrew 12y ago
On a related note, is there any device out there that lets you create a private key and "burn" it to that device in a way that the key cannot be taken off the device and you instead use the device the same way you use SSH_AUTH_SOCK? Ultimately, it would be nice to have a way where private keys can not be copied.

171 points by kim_rutherford 12y ago

How does it compare to the NeuG? Which entropy source is better? http://www.gniibe.org/memo/development/gnuk/rng/neug.html http://www.gniibe.org/memo/development/gnuk/rng/neug.html

WaywardGeek 12y ago
Note: I've only glanced at NeuG, so this is an over-simplified repy. Neug relies on a few different A/D inputs as a noise source. The resolution of the A/Ds is only 12 bits, meaning it is not capable of reliably measuring thermal noise in the system. In any case, it does not seem to be trying to measure voltage on a high impedance node. Therefore the data passed will be power supply noise and other sources of external influence. These potentially can be influenced by an attacker, maybe even remotely. I do like this architecture for a TRNG, and I like that it is open, but I do not believe the creator of NeuG has put nearly the TRNG know-how into this design as OneRNG. Personally, I'm looking forward to signing up on the Kickstarter for OneRNG when it happens.

Animats 12y ago

That's awfully complicated for a hardware RNG. A channel-hopping receiver? The classic solution is a radiation source, which quantum mechanics says is random. http://www.fourmilab.ch/hotbits/hardware3.html http://www.fourmilab.ch/hotbits/hardware3.html

crististm 12y ago
What part is in fact that complicated?
tribaal 12y ago
It's much much easier to build from cheap parts than something with a radiation source.
lgeek 12y ago
Maybe it is more complicated as a concept, but the implementation is much more simple. They're using a MCU with integrated radio, it's almost free to add the RF source to the base system only using the avalanche diode. A HV geiger tube and embedding a radiation source would be much more complicated / expensive to build, especially on small scale.
stormbrew 12y ago
I'm not sure about you, but I don't really think I'd want to keep even the minor sources of radiation described on that page in my pocket.
ganzuul 12y ago
From the same site, quantitative analysis: "The chi-square test is the most commonly used test for the randomness of data, and is extremely sensitive to errors in pseudorandom sequence generators. The chi-square distribution is calculated for the stream of bytes in the file and expressed as an absolute number and a percentage which indicates how frequently a truly random sequence would exceed the value calculated. We interpret the percentage as the degree to which the sequence tested is suspected of being non-random. If the percentage is greater than 99% or less than 1%, the sequence is almost certainly not random. If the percentage is between 99% and 95% or between 1% and 5%, the sequence is suspect. Percentages between 90% and 95% and 5% and 10% indicate the sequence is “almost suspect”. Note that our JPEG file, while very dense in information, is far from random as revealed by the chi-square test. Applying this test to the output of various pseudorandom sequence generators is interesting. The low-order 8 bits returned by the standard Unix rand() function, for example, yields: Chi square distribution for 500000 samples is 0.01, and randomly would exceed this value more than 99.99 percent of the times. While an improved generator [Park & Miller] reports: Chi square distribution for 500000 samples is 212.53, and randomly would exceed this value 97.53 percent of the times. Thus, the standard Unix generator (or at least the low-order bytes it returns) is unacceptably non-random, while the improved generator is much better but still sufficiently non-random to cause concern for demanding applications. Contrast both of these software generators with the chi-square result of a genuine random sequence created by timing radioactive decay events. Chi square distribution for 500000 samples is 249.51, and randomly would exceed this value 40.98 percent of the times. " - http://www.fourmilab.ch/random/ http://www.fourmilab.ch/random/
WaywardGeek 12y ago
The channel hoping is just a bit of software. It costs $0.00 in additional hardware. Software complexity is a big deal in a TRNG. The KISS rule applies big-time here. The more complex the software, the more likely it is a significant flaw will be found and exploited. It remains unclear to me whether there should even be a microcontroller on a USB TRNG. Without one, we can eliminate the complexity from the USB key itself, but we have to move the whitening and health monitoring to the driver. It is unclear to me if making the driver more complex opens it up to enough additional attacks that the system is less secure overall.
- deleted 12y ago
  [deleted]

tribaal 12y ago

Well, I'm happy to see that for once, they understand that the single most important thing is that it's verifiable. So many crypto-related systems ask you to trust the provider implicitly it's not even funny. I don't care who you are, if I can't look at the source (all the way down) of your product and build it myself, it's not going to make the cut as a "secure" system. You can provide additional guarantees and proofs, but showing me the source is item number 0. Sure, it's not perfect, but it's much closer to perfect than any alternatives.

gioele 12y ago
> You can provide additional guarantees and proofs, but showing me the source is item number 0. And item number 0.5 is allowing me to build the source and upload it to a pristine EEPROM chip.
- Taniwha 12y ago
  as part of our kickstarter we'll be offering programmers as an added reward - you can build the image from source and program your device - and we hope you do and share the results with the world You can't program it over the USB (although we could) we consider that that would be a security problem - and given recent security issues with programmable USB devices ....
  - notthetup 12y ago
    One of the kickstarter rewards could be the ICSP programmer HW (i'm guessing that's what you're using) so who ever wants to program it could do it.
    - Taniwha 12y ago
      we use a home-grown programmer - it's cheap but the bed-of-nails cable costs as much as the board - we wont be making any money on them
- tribaal 12y ago

zaroth 12y ago

A good CS-PRNG can take a modest amount of entropy and store it in a way (internal state) that you trust it can't be recovered by the attacker. From this they can generate a nearly endless supply of random output. That, as I understand it, is /dev/random vs. /dev/urandom/. So it's nice to have a good reliable source of entropy, but you can also consider how protected is the internal state, aka the place you stick that entropy? The better protected the CS-PRNG state, the less entropy you actually need. If you trust the CS-PRNG state, then hardware entropy sources won't matter much to you, because you just don't need that much entropy. When you start streaming entropy from many sources, it's probably to consistently update internal state over time because you don't fully trust that the state is secure. It should make no difference either way in the quality of the output (directly pulling entropy versus CS-PRNG output). Because the necessary amount of output to reverse-engineer state is almost infinite, the output of a properly implemented CS-PRNG is highly trusted. And they're really nice algorithms that have well reviewed implementations.

raverbashing 12y ago
Yeah, but you have a reliable source of entropy you don't need to get a lot of random numbers from your CSPRNG before reseeding.

gear54rus 12y ago

This seems sound. However, I'm in doubt about some of their points: > You can ask it to dump the current firmware to you It can dump the firmware but it can still execute something else than this (or in addition to) this firmware, can't it? > You can see all the components on the board The fact that I can see these tiny thingies doesn't do much good either? Can I, seeing them, tell what they do? No. Building one of these yourself seems to solve both problems. Not trying to undermine it or anything, just curious what others think of it.

tribaal 12y ago
The point is - you can verify it yourself. Without trusting anybody else. Dumping the firmware means you can ensure it's not been modified (presumably from when you uploaded it to the device yourself). Being able to inspect components means you can ensure it's still exactly as you built it. And if you haven't, you can visually check that it does what it says it does. If you're not technically competent to make this verification, you can ask somebody you trust and who is to do it for you.
- gcommer 12y ago
  None of the images show the other side of the board, but unless every trace is visible, it will be difficult to non-destructively inspect. If its only a 2 layer board then this just means scratching off the white silkscreen, which wouldn't be too bad. If its more than 2 layers, you would have to have access to an X-ray machine.
  - Taniwha 12y ago
    it's a two layer board - no buried wires or vias - by design there are very few wires on the bottom layer, none under the noise source (we want to contain the noise) - you can see all the wires without removing the solder mask just by holding it in the right light we'll be publishing the layout files of course
- joezydeco 12y ago
  How do we verify the internal microcode and switch fabric of the TI CC2531? IMO it seems like simply trusting the large block diagram that says "USB PHY" is a very weak point in the design.

bensn 12y ago

Suggestion for modification: Call it OpenRNG instead of OneRNG. In every second sentence i read the word open. Its obviously a main purpose.

Taniwha 12y ago
it's a sad pun, we're from NZ ....
- bensn 12y ago
  oh... Now I get it. I take my suggestion back xD
- notthetup 12y ago
  Just for that I will support you guys when it goes on kickstarter!
- hughes 12y ago
  Still took me a minute - OneRNG -> "One Ring" LOTR reference

deutronium 12y ago

I'm curious why they chose to use an avalanche diode which doesn't generate quantum-random numbers, unlike a reverse-biased transistor. As far as I'm aware, this means you could effect the numbers, by varying temperature.

Taniwha 12y ago
actually it is a reverse biased transistor
- deutronium 12y ago
  Aha cool, is the schematic online?
  - Taniwha 12y ago
    not yet, the actual RNG circuit is pretty standard - we'll put up the eagle files, along with the software sources, before we open the kickstarter
    - joeschmoe097845 12y ago
      If it's faster, could you put up a .png of the schematic? Also, the CC2531 looks like a QFN. Does it come in any hand-solderable packages?
      - Taniwha 12y ago
        There's an almost current schematic on the "Theory of Operation" page: http://moonbaseotago.com/onerng/theory.html http://moonbaseotago.com/onerng/theory.html few (any?) chips that do 2.5GHz RF come in chips with traditional pins (too much inductance). QFNs are completely hand solderable (with hot air, solder paste and a pair of tweezers)
  - WaywardGeek 12y ago
    Every TRNG I've seen so far that uses "zener noise" is actually using the reverse breakdown voltage across the emitter-base junction of a cheap NPN transistor. This is a zener diode! The reason this form of zener is used is simply because the fab does not bother to put in any effort to reduce the avalanche noise. Noise like that makes zeners sold as zeners unpopular. Zener avalanche noise is unpredictable. How is an attacker supposed to guess when the next electron/hole pair is going to be created in the depletion region? Physically, what happens is the emitter-base junction is reverse biased, turning it into a diode that is blocking current from flowing from the emitter to the base. Every once in a while, due to thermal noise and likely quantum effects, an electron jumps up a valence level, creating an electron/hole pair in the middle of the reversed-biased N/P junction, where there is a strong electric field. This launches the electron in one direction and the hole in the other, where they gain speed rapidly. The electron has higher mobility and will gain enough speed to bang into other electron/hole pairs, creating an avalanche of electrons. There is no known way for anyone to guess when the next avalanche will occur, or how large it will be, so long as there is no outside signal controlling this effect. Implemented poorly, it can just put out power supply noise, and not true unpredictable entropy. Implemented well, it is a solid, reliable, cheap, and fast entropy source. It is absolutely critical that a zener noise TRNG has an open auditable design! As for "quantum" effects, I consider that marketing fluff. What we need is provable, reliable unpredictability, not some radioactive decay or photon emission. We don't need 100% unbiased unpredictability either, just a signal that cannot be predicted with much accuracy.

gioele 12y ago

> It even has a “tinfoil hat” to prevent RF interference Isn't this a problem in the US, being against the famous part 15 of the FCC rules: «Operation is subject to the following two conditions: (1) this device may not cause harmful interference, and (2) this device must accept any interference received, including interference that may cause undesired operation.»

yen223 12y ago
Huh, interesting. What's the rationale behind the 2nd condition?
- DanBC 12y ago
  You have to design devices such that they don't fail when subject to interference. Put a mobile phone near a radio, send a text. You hear some burbling. Imagine that burbling is picked up by an insulin pump - you don't wan the pump to increase or decrease the dose based on that burble. See also analogue mobile phones which used to affect some gas station pump billing readouts. (CertInly some CB radios used to, whih caused bans, and phones are still banned in some stations today).
  - yen223 12y ago
    I think I misread that. It's supposed to mean "this device must be able to accept any interference received"?
nightcracker 12y ago
I'm fairly sure that the "accept" does not refer to "absorb without any countermeasures". It's a bit poorly worded. I think it refers to the fact that if your device fails due to interference below the legal limit it is your problem to fix, not the device that generated the interference.
- dfox 12y ago
  I always assumed that it refers to the fact that interference under certain limit should not permanently destroy the device even when such interference may cause the device to behave erratically.

Taniwha 12y ago

Note: I'm Paul the designer Some background - this board is in late beta testing, we're going to kickstart it and release it (with papers scheduled at a couple of conferences) - it's hitting Hacker News a little early - but keep us in mind when we do finally release to the public - at the moment we haven't published the design - we'll be putting up both the firmware an hardware designs on GitHub when we think it's ready for the public (almost there) If you want some idea of the code and development system it's largely based on the dev system for out IoT project: http://www.moonbaseotago.com/cheaprf/ http://www.moonbaseotago.com/cheaprf/ Meanwhile I'm happy to answer questions

dspillett 12y ago
> we're going to kickstart it and release it Do you have any timescales for that yet, or are such decisions still heavily dependant on feedback from testing?
- Taniwha 12y ago
  testing is good, no known roadblocks, we planning on a Decemberish time frame, we think we have a final firmware load at this point. We have a small pick-and-place machine/etc setup we'll do a small in-house run for those who want to pay a premium for early delivery and then possibly a slower run depending on demand.
  - PhantomGremlin 12y ago
    > We have a small pick-and-place machine/etc setup I've been in at the ground floor of a number of successful hardware startups. One of which had a number of pick and place machines, IR reflow ovens, and all sorts of related manufacturing equipment. So I'm quite familiar with the field. My very simple, very emphatic advice about a "pick-and-place" machine is: NO NO NO NO NO, a thousand times N0!!! Maybe it's something you have to do in NZ. But in some other parts of the world, if I blindfolded you and let you stumble around you would probably trip over a pick-and-place machine in about 5 minutes! They're everywhere. In other words, unless your primary purpose is to bootstrap yourself into being a contract manufacturer, you have absolutely no business owning your own pick-and-place machine. A design as simple as yours could be manufactured by almost anyone in the world. It's so simple that most of them could do it in their sleep. Just contract the manufacturing out and be done with it. Your quixotic effort at stuffing your own boards reminds me of the perhaps apocryphal story of, in the 1970's, WDC designing a chipset that was used in the DEC LSI-11 minicomputer.[1] They had a fab, and in one week they could make enough chips for DEC to sell minicomputers for a year. "Okay, the LSI-11 chips are done. Now WTF do we do with this fab for the other 51 weeks of the year???" Yeah, in the old days IC fabs were cheap enough that everyone and his brother owned one. And they had large fixed costs. And unless they were utilized around the clock they lost money. To a large extent stuff like pick-and-place machines are the same. Sure it's orders of magnitude cheaper. But still, maybe it takes you a week or two to build some of your boards. What do you do with your equipment for the other 50 weeks of the year? Is that the business you want to be in? Of course, if that is the business you want to be in, then OK. [1] http://en.wikipedia.org/wiki/Western_Digital#1970s http://en.wikipedia.org/wiki/Western_Digital#1970s

notthetup 12y ago

If the avalanche diode is the main/primary source of entropy why do we need the CC2531? The super paranoid part of me is worried about the 802.15.4 radio being used as a vector to taint the RNG. Shouldn't an HW RNG NOT have any secondary communication method built in? I am guessing you guys added that because that's the platform you're working with for your IOT project, but it just seems a little overkill to me. The diode data acquisition and the USB comms could be easily done using any Cortex-M0 type micro.

Taniwha 12y ago
I think that's a fair point, I agonized over it for quite a while - the cc2531 was the USB device/ and stack I was building with at the time. This is the main reason why by default the device disables the RF source, you have to go out of your way to enable it by editing an /etc .conf file - however it actually does make a slightly better random stream
- WaywardGeek 12y ago
  Is it possible for this device to transmit over radio, or only receive? I certainly prefer only being able to receive, as transmitting seems like an attack vector. With the assumption that it only receives, I would strongly prefer that it be left on by default. Adding a second source to the CRC mixing can only improve entropy, even if the source is controlled by an attacker. Since the noise from the zener has no simple proof of it's entropy output rate, and it can vary over time, and because zener noise TRNGs have been known to be power-supply noise sensitive (not that your's is), having that second source gives me much more confidence in the device.
  - Taniwha 12y ago
    It could transmit, there is no transmit code in the firmware, in fact there's no real receive code, we turn on the receiver and sample the LSB of RF noise in the sampling DACs but don't enable any demodulation or framing. Turning both RNGs on only gets you a about half a bit/byte of extra entropy - but it is a great belt and braces sort of thing, makes it much harder to attack, especially since the sampling clock inside the device for both sources is not visible eternally Remember we don't use the output data directly, we mix it into the kernel's entropy pool (where it's whitened)

imaginenore 12y ago

Or you could just use a shitty cheap webcam and take the lower bits of each pixel (or one pixel of each 8x8 block if the compression is bad). The amount of randomness per second webcams generate is pretty insane, it's more than enough to feed the seed of a crypto PRNG function like Fortuna.

WaywardGeek 12y ago
There are plenty of decent sources of entropy, like webcams and sound cards. However, they all add parts we don't need, and they don't take any care to design with security in mind. Eventually, a good open hardware TRNG should be cheaper, more reliable, easier to use, and more secure than any of those solutions, IMO.
- imaginenore 12y ago
  > they all add parts we don't need What are you worried about exactly? Space? There are really really tiny cameras for smartphones that are mass-produced, and they are very noisy, which is perfect.

malgorithms 12y ago

A question for the designers (Paul?) about verifiability. In the software world you can effectively choose from 2 levels of review. You can (1) review the source code of a project and convince yourself it's fine. Or (2) you can assume/hope that experts have done that, download the software, and just verify you have an identical copy of what everyone else is reviewing. (Ideally using signatures of the authors and reviewers.) Almost everyone who cares does step 2, assuming they do anything at all. Very few people are qualified or bother to review source code, but everyone who performs step 2 can feel pretty safe, as long as a release is big enough that it's getting reviewed by experts. So, what's the hardware equivalent? If I'm not capable of reviewing the schema of this hardware, but someone I trust says "this is great", how do I at least know the one I bought is identical to the one she/he bought (or built) and reviewed? How do I verify the components? This seems like a difficult problem.

robzyb 12y ago
You run your "verified" software on hardware, right? How do you know the hardware is verified?
- Taniwha 12y ago
  we publish the hardware design - in reality we have to run it on someone's chip, we've picked one that includes among other things AES, we just don't use that stuff, at some point we have to trust the CPU, and we use a CRC32 engine for minor whitening and stirring of our internal entropy pool - but crc32 is easy to verify (while AES is not) more importantly we've chosen a platform that we think is unlikely to have already subverted by 3 letter agencies
tribaal 12y ago
I think the idea is that the components are simple enough in the case that it can be reviewed visually by inspecting the circuit board and comparing it to a signed/verified reference. The last bit that is missing then is the chip's firmware, but apparently it is possible to get a dump of the firmware, so you can at least ensure it is what you expect. It will be a pretty interesting problem for cases. How can you both make a case that is practical and lets you inspect components? Maybe encasing the circuit board in transparent resin would work, but then you can't reprogram it anymore (which might be a feature). EDIT: Oh, that username rang a bell. Hi Chris :) Keybase.io FTW!

robomartin 12y ago

Back about 25 years ago I wanted to build a PC card to generate better random numbers. The idea I had at the time was to build in a set of four or five FM/AM radio receivers into this card and have them hop ratio stations constantly at, well, random intervals. Then I'd use the digitized audio signals in some combination to feed a random number generator. I thought it was a good idea at the time. Well, I didn't have enough experience yet to know just how much I didn't know. Never built it.

lifeformed 12y ago

Total layman question here, but how does an avalanche diode work?

PhantomGremlin 12y ago

If this gadget sells for under $50 (which it certainly should) I might consider buying one, just for the fun of it. But I haven't seen anyone here mention ID Quantique, one of the companies that the "big boys" use for random numbers. They're in Switzerland: http://idquantique.com/ http://idquantique.com/ Admittedly not open hardware, but FWIW they claim: QUANTIS has been evaluated and certified by the Swiss Federal Office of Metrology (also known as METAS), the Swiss national organization in charge of measurement science, testing and compliance. It confirmed that the quality of its random output complies with the highest requirements. The minor detail about buying from ID Quantique is that their cheapest USB product sells for about 990 euros, or about $1250.[1] I know it's apples and oranges, but anyone interested in this product should at least be aware of some alternatives. [1] http://idquantique.com/component/content/article.html?id=83 http://idquantique.com/component/content/article.html?id=83

malandrew 12y ago

On a related note, is there any device out there that lets you create a private key and "burn" it to that device in a way that the key cannot be taken off the device and you instead use the device the same way you use SSH_AUTH_SOCK? Ultimately, it would be nice to have a way where private keys can not be copied.