Hardware Random Bit Generator

https://web.jfet.org/hw-rng.html

by Tomte • 3 years ago

93 44 3 years ago

web.jfet.org

daneel_w2• 3 years ago

I came up with the same idea when I was 15 years old around the mid-90s, but for an entirely different purpose. I had an interest in electronics and analog synthesizers and I was trying to figure out a way to replicate the Commodore 64's audio chip's (https://en.wikipedia.org/wiki/MOS_Technology_6581) ability to produce unfiltered noise of any audio frequency - something else than just low-pass-filtering white noise to get pink and brown etc. noise - and it struck me that running white noise from a transistor wired in reverse through a tunable sample-and-hold circuit would produce the desired result. Years later it dawned on me that it would also be a good source of random data if it at a suitable frequency was fed through an ADC.

pipo234• 3 years ago

Years later it dawned on me that it would also be a good source of random data if it at a suitable frequency was fed through an ADC.

To be pedantic, I think you mean good source of entropy, rather than random data. The raw ADC data is likely to have statistic (Gaussian) bias, which would mean trouble if randomness in the crypto sense were the objective. Ie. you would need to whiten the bitstream (using some kind of hash) to make it useful in a (P)RNG.

But nevertheless, a great idea to start with: cheap and relatively reliable.

daneel_w2• 3 years ago

"To be pedantic, I think you mean good source of entropy, rather than random data. The raw ADC data is likely to have statistic (Gaussian) bias ..."

It might have. There are also various ways of affecting the spectrum of the noise generated by the transistor using electromagnetic and thermal influence. But can you can positively discern that output as absolutely biased or affected, and crucially would you be able to take actual advantage of it? I'm not really certain, but for this type of solution I'd still err on the side of it not being a feasible attack.

dahart• 3 years ago

It’s okay for people to use the word “random” without meaning secure cryptographic randomness, even in a technical setting. To be pedantic myself, the word “random” has many legitimate meanings, so we don’t need to impose the most strict version of our favorite term of art on people any time an overloaded word is used, right? It’s fine to ask or point out or discuss the nuance, but saying “I think you mean X” is likely to be an incorrect assumption, no?

vbezhenar• 3 years ago

I thought about connecting headphones and mic in a way, so mic will catch headphones sound and amplify it (you know this terrible sound). I feel like it should contain some randomness, so might be an "low budget" option for those of us who can't distinguish resistor from transistor.

dale_glass• 3 years ago

That's feedback and it's very much not random. These days there are audio tools that automatically eliminate it, which wouldn't be possible if it was random.

goalieca• 3 years ago

To be pedantic, noise removal works great if you know the signal, but still works great if you model it as a statistical distribution.

picture• 3 years ago

Also see Infinite Noise TRNG https://github.com/waywardgeek/infnoise

magicalhippo4• 3 years ago

Tried simulating this circuit in LTSpice and failed miserably. Anyone got a working circuit to share?

Given the feedback nature of the circuit I assume it's sensitive to all kinds of device-specific limitations like slew rate and so on, so hard to get a realistic simulation.

ur-whale2• 3 years ago

Tried simulating this circuit in LTSpice and failed miserably

I have one somewhere, let me dig it out (it of course won't produce true randomness since it's a sim, but close enough to understand how the circuit works, which happens to be the closest I've seen to actual recursion in analog electronics).

Here: https://github.com/threeTB1rao/infrng-ltspice

Taniwha5• 3 years ago

This circuit is just about the standard one that everyone has used for decades (weirdly biased 2N3904s to make an avalanche diode)

I sell OneRNGs (currently out of stock more coming soon) that use a version of it, however SMT 2N3904s have been EOL'd, next generation will need to use something different (probably a zener)

mananaysiempre• 3 years ago

for decades

Well, the earliest quoted article is from 1995 :)

magicalhippo4• 3 years ago

however SMT 2N3904s have been EOL'd

Can't you use the MMBT3904? DigiKey has several active suppliers of that (in SOT-23, as well as other packages).

Taniwha5• 3 years ago

ah hadn't noticed those - the big problem with this circuit is that if need to need to be able manufacture something it needs to be reliably repeatable - I've found I need to buy a reel made by a particular manufacturer and tweek the circuit just so.

adrian_b2• 3 years ago

An actual Zener diode is preferable to an avalanche breakdown diode improvised from a bipolar transistor.

The Zener diodes are designed so that avalanche breakdown happens in a controlled location, in the bulk of the silicon crystal, so it can be sustained for decades without any changes in behavior.

The avalanche breakdown of the emitter junction of most bipolar transistors is not a controlled mode of operation and it happens in some random location, normally at the external surface of the silicon crystal.

While a Zener diode is designed so that the avalanche current is spread over a large area, to avoid local overheating, in the bipolar transistor the avalanche current may become concentrated in a very small spot, so that the current density can become very high, despite the fact that the current is limited to a very small value by the external resistor.

The small spot where the current is concentrated can become very hot, even up to causing the melting of the crystal. The initial avalanche path may become either insulating or equivalent with a resistor with a very high value in parallel with the junction.

Then the avalanche breakdown will move to another spot on the periphery of the emitter junction, and the cycle will repeat.

This leads to slow fluctuations in the breakdown voltage of the transistor emitter junction and in the amplitude of the noise during the lifetime of the device, which leads to a time-dependent statistical bias of the random bits.

In rare cases, after a long time of use, the reverse-biased emitter junction can become completely resistive, in which case it will still generate thermal noise, but this noise has a lower amplitude than the initial avalanche noise. If the amplifier does not have a gain high enough, the noise may become unable to flip the output gate most of the time, leading to a strong bias in the output.

If the hardware random bits are used only as an input to a secure hash function, then the not-ideal properties of the hardware RNG should not influence the output, as long as the bias of the random bits does not become so extreme as to cause a non-negligible probability of identical bit strings occurring as inputs to the hash.

Also, the schematic with 74ALS04 is quite dated, as such legacy integrated circuits, which have not been used for many decades in new designs, may be hard to find.

If 74ALS04 would be replaced with modern ICs, some changes would be necessary.

Reproducing the schematic with equivalent CMOS gates is dangerous, because the CMOS gates biased into the linear mode of operation have a very high power consumption and they may latch-up, short-circuiting the power supply.

There are many ICs with multiple fast operational amplifiers in a package, which are better suited and safer for the amplifier stages.

Also using a standard CMOS gate at the output would be dangerous. It is much safer to use a Schmitt-trigger gate. Such Schmitt-trigger gates can be found in packages with a single gate that are no bigger than a transistor.

If the noise generator would be used with a microcontroller, then the output gate would normally not be needed, because most microcontrollers have Schmitt-trigger inputs on their GPIO pins.

SomeoneFromCA2• 3 years ago

Totally agree, it is well known that reverse biasing emitter into breakdown will degrade the performance of device.

But how exactly "using a standard CMOS gate at the output would be dangerous"? Because of not providing good zeros an ones, with sharp fronts? High power consumption?

I also do not remember that microcontrollers datasheet explicitly specfied that inputs a Schmitt-triggered. The may be, but I have vague recollection of AVR 90S2313 consuming more than needed power when fed with analog signal on a digital pin.

SomeoneFromCA2• 3 years ago

That poor emitter-upside-down BJT will degrade quickly and won't be fit to be used for normal amplification purposes - noise increases, hFE will go down and all kind of bad things will happen to it. So if you are planning to experiment with it, do not reuse that BJT for analog purposes.

ur-whale2• 3 years ago

Worse : the quality pf the HW RNG will degrade steadily over time.

There are much better and stabler ways to generate noise with analog circuits

    . FPGA based inverting gates ring oscillator, which when sampled with a proper crystal-based clock produce noise because the ring oscillator phase-drifts

    . thermal noise in a tiny resistor, amplified, the method used by intel chips for their built-in hw gen instruction

    . infinite rng, mentioned elsewhere in the thread

    . this one (NSFW, the author is weird, but the circuit is interesting, uses comparator hysteresis instability): 
            http://nosuchlabs.com/fg/fg.png
            http://nosuchlabs.com/fg/trng_tw.png

Note that many of these RNG produce very crappy random numbers from a uniformity perspective (distribution is rarely uniform).

Also note: the fabled von neumann method to uniformize the output has one giant drawback: you lose any guarantee of sustained bandwidth.

Also, also note: however crappy the quality of the bitstream generated, using it to regularly seed a crypto hard hashing algorithm will give you very uniform and practically unguessable stream of random bits, way better than the von neumann thing.

Here's a compendium of HWRNGs:

https://github.com/atoponce/awesome-hwrng

photochemsyn• 3 years ago

"People talk about using radioactive sources, and that probably gives better randomness, but a more practical approach is to use noise from a reverse-biased PN junction."

Americium-241, the active component in smoke directors, has a half-life of 432 years, so it should be possible to build inexpensive hardware devices capable of generating a stream of true random numbers that probably could be designed meet all the statistical requirements needed for cryptographic seeds. It's surprising that something like this isn't available; it could be a standard on-board component or packaged into a usb device.

brudgers3• 3 years ago

It's surprising that something like this isn't available

Cryptography is a munition (in the US).

https://en.wikipedia.org/wiki/Export_of_cryptography_from_th...

That might explain the non-ubiquity of convenient random number generator hardware under a hypothesis that widespread use would make signals intelligence much more difficult for three letter agencies.

YMMV.

tptacek2• 3 years ago

It would do no such thing. Commodity computing devices are plenty capable of generating key material without specialized circuitry.

loeg• 3 years ago

No one needs a random source that meets statistical properties unfiltered; you just need something good enough that can be filtered, compressed, and distilled into a few unpredictable bits. 256-512 high quality bits are enough to seed everything else for an indefinite period of time. If your random source only has ~0.1 bit-per-byte of entropy but can produce 30,000 biased bits quickly, that's enough to seed the system.

https://blog.cr.yp.to/20170723-random.html

dfox• 3 years ago

Many contemporary computing platforms have some kind of HW RNG built into them, these are often regarded with some kind of skepticism as they are not really auditable.

The larger issue is that these are not really needed, any device that does something useful (ie. interacts with the outside world) and retains some kind of non-volatile internal state is perfectly capable of generating cryptographic randomness purely in software.

eternityforest2• 3 years ago

Yes but then you would have to own something that contains Americium.

We put up with it in smoke detectors because house fires are more scary than the radiation, but I don't see why you'd want even the tiny extra risk of the thing getting somehow broken or burnt in an illegal recycling fire or something, just for random numbers.

Maybe you could do a safe version that used a banana as the radioactive element, it would make enough entropy to seed a RNG.

ooterness• 3 years ago

Bunnie Hwang's "Betrusted" project uses a pair of circuits as an entropy source, with a few blog posts describing the how and why of the design.

One source is a ring oscillator, internal to the Betrusted FPGA. The other is an avalanche noise source similar to OP, external to the FPGA.

The two streams are XOR'd and then run through a cryptographic hash.

https://github.com/betrusted-io/betrusted-wiki/wiki/TRNG-cha...

https://github.com/betrusted-io/betrusted-wiki/wiki/TRNG-Dat...

thinkski• 3 years ago

From the article: “To get a TRULY random number sequence, you'd need to rely upon some truly random phenomenon, like the decay of a radioactive isotope.”

How is the true randomness of a physical phenomenon proved? Perhaps naively, I imagine that as an arithmetic-based software RNG is deterministic, so is a physical RNG, as otherwise the underlying physical process would be governed by no physical principals, no? Does random in this case not necessarily mean non-deterministic, but rather no statistically visible correlations?

H8crilA• 3 years ago

Quantum mechanics, and the specific proof is the subject of a recent Nobel prize (practical demonstration of a violation of a Bell's inequality). Shame that Bell himself didn't live long enough to get the prize too.

In fact everything you observe is truly random, it's just that for most things the probabilities are very boring, at least as far as you can practically tell.

dchest• 3 years ago

https://physics.stackexchange.com/questions/340530/how-do-we...

replyifuagree• 3 years ago

A hardware noise generator was cost reduced off of a keno device and a guy working in the Nevada Gaming lab noticed that when the device was reset it would start over in the same spot in the RNG sequence. He kept this discovery to himself and didn't reject the new hardware and firmware like he was supposed to.

He got caught because the first time he and his accomplice tested their rig out in Atlantic city they hit an astronomical odds jackpot (something like 14 of of 15 numbers).

csense• 3 years ago

I don't really understand analog electronics very well and I wish this was a bit better explained for a general audience.

I think +18V is enough for some quantum physics to happen and suck an electron through the first transistor even though no current is "supposed" to flow, and because it's coming from the base, that turns the second transistor "on" a little bit and "tries" to "brown out" the second transistor's collector causing the voltage at the first capacitor to drop.

This is where I get very lost and confused, because to me if you're trying to enhance the "brownout" to 5V, why in the world would you put a capacitor there?

I know the capacitor not connected to ground is called "AC coupling" and it somehow passes high frequencies but not low ones or something like that, but I don't really understand it at all. It's really hard for me to understand how putting a large capacitor near such a tiny signal doesn't simply cause that signal to get lost in the capacitor's ocean of capacity for absorbing electrons.

Then I tried to look at what the 74AL304 is doing, it's apparently a standard inverter, but I think it's trying to be used in an "analog" way here. The inverter is "trying" to calculate "A = ~A" but since the connection from input to output is a resistor, you can't think in digital terms and you have to look at its analog characteristics.

I found a datasheet on TI's website but it doesn't have much information about its analog behavior, I'm thinking that to begin to understand what it does, I'd need a voltage sweep curve or a diagram of the internal transistors of the 74ALS04.

My intuition is that the electric force is really strong, so when an electron comes onto one side of the capacitor, it forces an electron off the other side, so if you black-box the capacitor, it "acts like a wire": Current that goes in one side comes out the other side. (I'll run with this for this post, but now I have another unanswered question, "Okay then, if electron in side A = electron out side B, how is a capacitor different from a wire?")

So the 74ALS04 is "trying" to raise its output when the input is low, and lower its output when the input is high. Therefore if you sweep the input voltage, at some point it must switch from "trying" to raise, and begin "trying" to lower. By connecting output and input, a too-low or too-high voltage drives the inverter toward the crossover point, and forces it to stay there.

Now if you suddenly force an electron into the input of the inverter, it has to react by sending the output in the opposite direction. The circuit designer seems to have assumed this occurs in an amplifying way, at least in this circuit.

It's still very confusing for me to imagine the input and output of the inverter at different voltages, because then current is flowing through the resistor, but where does that current go? Maybe it goes back into the capacitor?

Okay, so a tiny voltage drop at the inverter's input causes it to surge current to its output. A tiny amount of the surge goes back through the 27K resistor which eventually raises the input voltage so the surge shuts itself down, but most of the surge goes through the low-resistance path and flows into the next stage's capacitor (how many stages you need depends on the amplification factor vs. how small the input signal is), then after the two stages you have a final "normal" inverter gate cleans up the signal so you have a digital output.

I still don't understand AC coupling. Anyone care to take a crack at explaining why the capacitors are necessary, and what happens if you replace them with wires?

Hardware Random Bit Generator

Related Stories