3 ms·
Intel includes a TRNG in their CPUs (on die) since Ivy Bridge. It used to be called Bull Mountain. Now it is known as RdRand after the instruction. Here is a go
by JoachimS 11y ago
Intel includes a TRNG in their CPUs (on die) since Ivy Bridge. It used to be called Bull Mountain. Now it is known as RdRand after the instruction. Here is a good article about it:
http://spectrum.ieee.org/computing/hardware/behind-intels-new-randomnumber-generator http://spectrum.ieee.org/computing/hardware/behind-intels-ne...
The problem is that it is a black box. Intel has added the ability to seed the generator (rdseed), but it does not really reduce the issue of trust.
- jacquesm 11y agoIf you can seed it then it is not a true random number generator but a pseudo random number generator. Also the rdseed instruction does not allow you to seed the generator but instead allows you to generate seeds for other (pseudo random) generators.
- mcpherrinm 11y agoThat's true. There is both a CSPRNG and a TRNG: https://software.intel.com/en-us/blogs/2012/11/17/the-difference-between-rdrand-and-rdseed https://software.intel.com/en-us/blogs/2012/11/17/the-differ...
- stephencanon 11y agoRDSEED does not let you seed the RDRAND generator. It provides random data intended for seeding a software PRNG. https://software.intel.com/en-us/blogs/2012/11/17/the-difference-between-rdrand-and-rdseed https://software.intel.com/en-us/blogs/2012/11/17/the-differ...
- caf 11y agoRDSEED is not for seeding the generator, it also reads a random number. The difference is that RDSEED reads directly from the hardware random bit generator whereas RDRAND reads from a CSPRNG itself seeded by that random source.
- paulmd 11y agoQuick summary of dopant-mask trojans: small alterations to the chip's masks can "pin" bits of the internal PRNG state high or low. Because the output of the PRNG go through a cryptographically secure hashing algorithm the output appears to have good entropy but assuming you know which bits are pinned the actual keyspace you need to search is catastrophically smaller. Intel includes checksums that run at system startup to verify the functionality of the PRNG but these are aimed at catching manufacturing errors, so they used CRC32. Thus, all you need to do to break this is be sure that the internal state of your pinned PRNG and the fair PRNG produce a CRC32 collision after running the test pattern. http://sharps.org/wp-content/uploads/BECKER-CHES.pdf http://sharps.org/wp-content/uploads/BECKER-CHES.pdf If RDSEED doesn't run through the hash, would that give you enough of a window into the PRNG's internal state to be able to catch that attack? It sounds promising but it looks like RDSEED came out in 2012, so that would predate the paper...
- userbinator 11y agoThe problem is that it is a black box. So is this one... it's also closed-source hardware.