USB True Random Number Generator

http://www.entropykey.co.uk/#

by frossie • 16 years ago

58 46 16 years ago

entropykey.co.uk

mbreese• 16 years ago

Is the lack of entropy really a bottleneck in a server?

scdlbx• 16 years ago

If the application running on the server needs to generate a lot of random numbers, yes.

JoachimSchipper2• 16 years ago

Only if they need to be cryptographically secure - a PRNG, occasionally seeded with "real" entropy, is sufficient for almost all uses.

mey• 16 years ago

High volume SSL/SSH traffic. Systems can be configured to fall back to insecure random number generator under load but it creates an attack vector where you intentionally DoS a system, then have more leverage to crack the encryption based on the weak(read predictable) random data the encryption is based on. The practicality of such an attack is beyond my knowledge.

davidu• 16 years ago

Yes, it can be. In addition to a security issue making timing attacks more practical if an attacker knows they can deplete the entropy pool in a repeatable fashion.

nysauhem• 16 years ago

It never says that it generates true random numbers, just a "better" random

brianto2010• 16 years ago

From the 'tech' page:

> "...it has a pair of devices that are wired up in such a way that as a high potential is applied across them, where electrons do not normally flow in this direction and would be blocked, the high voltage compresses the semiconduction gap sufficiently that the occasional stray electron will quantum tunnel through the P-N junction. (This is sometimes referred to as avalanche noise.) When this happens is unpredictable, and this is what the Entropy Key measures."

'Unpredictable' would qualify as random.

rubidium• 16 years ago

I like this one (http://www.idquantique.com/true-random-number-generator/quan...) better.

If I understand both correctly, the Quantis one generates a random number that didn't exist before generation due to quantum measurement principles, whereas the Simtec one uses a high noise environment in which the number does exist before measurement.

hga2• 16 years ago

They look very nice and are high output (4Mbps to 16Mbps max for the PCIe version) but are quite a bit more expensive, 890 € to 1165 € quantity one.

Confusion• 16 years ago

You're repeating nonsensical marketspeak. What does "a number that didn't exist before ..." even mean? And what does "quantum measurement principles" mean? I'll tell you: it means diddly squat.

The device the article is about measures electron flow through an electronic component through which 'usually' no electrons flow. That electrons flow in this device, is because they tunnel through the potential barrier. That's a quantum effect if there ever was one.

Converting the presence of electron flow into a number means you construct these numbers on the fly. The numbers did not 'exist before', for any reasonable meaning of that term.

Robin_Message• 16 years ago

Acutally, Simtec states: "each 256 bit block of data handed to the host was formed from somewhere in the region of 3840 bits read from the quantum generators."

Yes, you can buy "quantum generators" for only £36!

Seriously though, the noise that Simtec is measuring is unpredictable and based on a quantum process (electron tunnelling.)

randomwalker• 16 years ago

This is silly. The whole reason that cryptographic random number generators exist is to avoid the need for lots of entropy. You can start from 80 bits and "bootstrap" it to whatever quantity of random bits you need (and the seed entropy needed is available from /dev/random). PRNGs come with the guarantee that telling the difference from "true" random numbers is a hard problem.

You might claim that the hardness guarantees of PRNGs are not enough for you -- they are based on some assumptions after all -- but that is a specious objection, because those are the same assumptions that underlie all of digital security and e-commerce.

tudorachim• 16 years ago

I think the main advantage is that this RNG gives you the same results as a crypto-strong PRNG, but much faster. That said, I didn't see any benchmarks on their site.

dododo3• 16 years ago

what are these guarantees you refer to? most pass a battery of tests e.g., diehard: http://www.stat.fsu.edu/pub/diehard/ but if you give a PRNG x bits of entropy, then it can produce at most x bits of entropy over its entire output.

all PRNGs have cycles: that is, they'll produce random numbers x[1], x[2], ... , x[n], then random number x[n+1] = x[1], x[n+2] = x[2], .... often n isn't as big as you'd like, and sometimes there are correlations among x[i] and x[i+k] you really don't want (linear congruent generators have this problem).

stcredzero8• 16 years ago

Run the output through a hash function, and also get another 80 bits of entropy before you get to the critical n where your generator repeats.

JoachimSchipper2• 16 years ago

It doesn't work like that. If you use this to create, say, a cryptographic key, you can break it if you can bruteforce an 80-bit key; depending on the specific application, you may need much less (e.g. if you can perform a birthday attack, you only need 2^40 tries).

maushu• 16 years ago

Notice on how they use "high-quality" in the first three paragraphs?

hga2• 16 years ago

Quantity 1 £36.00 with plenty of quantity discounts. Might be just the thing to make sure your VMs have enough entropy (I've read this can be an issue when they start up).

aidenn0• 16 years ago

I don't know if things are improved, but the last time I looked into HW random number generators, it was RS-232 connected ones, and the quality control was terrible a fairly high percentage of them generated very low quality random numbers. You would think you could mitigate this by xoring two of them together, but this made things much worse since 2 connected to the same outlet tended to be somewhat correlated!

My impression of the HW random number generator industry was that it was all snake oil, only the people selling them didn't necessarily know that was true.

Se also: http://web.archive.org/web/20011027002011/http://dilbert.com...

[edit] The technical section of the webpage[1] directly addresses most of the problems that the RS-232 devices I looked into a number of years ago had; namely it detects when the diodes are going bad, and tries to not exceed the estimated entropy rate (the RS-232 devices just blindly XORed them together at a predefined bitrate; boxes typically had 4 diodes, since 1 or more was bad in almost all shipping boxes). My experience was so bad with those devices though that I would want to spend a lot of time with any HW device before trusting it.

1) http://www.entropykey.co.uk/tech/

statictype• 16 years ago

>fairly high percentage of them generated very low quality random numbers

How do you judge the quality of a series of random numbers?

po2• 16 years ago

You run a bunch of Diehard tests on them:

http://en.wikipedia.org/wiki/Diehard_tests

ciupicri• 16 years ago

FIPS 140-2 mentions some tests. [1]

[1] http://www.fdk.com/cyber-e/pdf/HM-RAE103.pdf

stcredzero8• 16 years ago

You would think you could mitigate this by xoring two of them together, but this made things much worse since 2 connected to the same outlet tended to be somewhat correlated!

I would collect the bit stream then run the result through SHA256 in 256 bit batches.

DavidSJ• 16 years ago

My impression of the HW random number generator industry was that it was all snake oil, only the people selling them didn't necessarily know that was true.

In general I find that snake oil salesmen don't realize that they're snake oil salesmen.

jacquesm2• 16 years ago

It is incredibly hard to make a really good random number generator in hardware. The best I've ever managed to come up with was also a diode based white noise generator with a PIC chip to digitize the output of the diode after amplification.

One of the problems of that approach is the low quality of the built in A/D converter of the PIC, another the ease with which powerline hum and other electromagnetic noise made it into the circuitry. We did get the circuit to work, but it was hard to duplicate with lots of fiddling required before we had a series of 4 of them good enough for production use.

A typical test run would take a week and it was not rare to see 'good' performance on a test run of a day while still having to discard components after a week.

They were used to power an online casino.

stcredzero8• 16 years ago

What about hashing the output from the A/D converter?

brianobush• 16 years ago

In the past, I used random numbers from: http://www.fourmilab.ch/hotbits/ sourced from radioactive decay. The only issue I could see was the daily limit, but I only needed several kilobytes of randomness at any one time.

sliverstorm2• 16 years ago

Considering the ultimate doom of the universe is very possibly infinite entropy, sometimes it bemuses me on a philosophical level that we try so hard to accelerate the process.

jim_dot• 16 years ago

I'm all for protecting our children from the harmful effects of entropy, but not our children's children because I don't think that kids should be having sex.

pyre• 16 years ago

The only thing that I could come up with for 'infinite entropy' in Google was a piece about how 'big bangs' start from nothingness in empty space when the Universe 'cools off' or becomes 'too thin.' In that case, it seems like infinite entropy isn't necessarily the 'doom' of the Universe.

sliverstorm2• 16 years ago

It is in the sense that nothing will be left, and the space-wide temperature will be arbitrarily close to zero K

I mean, the Universe wouldn't vanish or explode. We'd just all be dead, and it'd stop being interesting, the same way your magnesium strip is pretty boring and useless once it's finished burning.

stcredzero8• 16 years ago

What about collecting microphone input and running it through a hash?

dazzawazza• 16 years ago

That is a recognised method but it does have it's own failings. Certainly in server rooms although it seems noisy to us there are patterns that can still be generated.

Another similar method is to take static from radio waves. While random it's unfortunately hackable by someone who has a radio transmitter and can get close enough to your antenna (the same can be done with the microphone).

I worked at a poker startup and sourcing random numbers is both a political and mathematical nightmare.

stcredzero8• 16 years ago

Add another noisemaker with a chaotic component, like a Pacinko ball game with an automatic ball feed. Hashing the output will obliterate the patterns.

lutorm• 16 years ago

Why not add a small amount of radioactive material and measure decays?

samlittlewood• 16 years ago

A GPL hardware RNG, using a bunch of ring oscillators in a CPLD:

http://warmcat.com/_wp/whirlygig-rng/

AdamN2• 16 years ago

One of their prime arguments is about the 4KB bucket available for random numbers on a standard Linux installation. Couldn't/Shouldn't that be raised to 1MB or so for server installations and that would solve the bandwidth problem if not the randomness problem?

AdamN2• 16 years ago

Does anybody know configuration options for managing this BTW?

USB True Random Number Generator

Related Stories