True hardware random number generator for $50

https://www.tindie.com/products/ubldit/truerng-hardware-random-number-generator/?utm_source=Tindie+Community&utm_campaign=bb1695b2d4-Featured_Product_Newsletter_5_21_15&utm_medium=email&utm_term=0_bb799798bb-bb1695b2d4-86719057&mc_cid=bb1695b2d4&mc_eid=6cb48920b3

by sanoli • 11 years ago

69 74 11 years ago

tindie.com

RyanRies• 11 years ago

On one hand, this is very cool. On the other hand, why can't Intel/AMD just put this sort of thing on their CPU dyes and be done with it?

daniel-cussen• 11 years ago

I know Intel has, it's called RDRAND.

JoachimS• 11 years ago

Intel includes a TRNG in their CPUs (on die) since Ivy Bridge. It used to be called Bull Mountain. Now it is known as RdRand after the instruction. Here is a good article about it:

http://spectrum.ieee.org/computing/hardware/behind-intels-ne...

The problem is that it is a black box. Intel has added the ability to seed the generator (rdseed), but it does not really reduce the issue of trust.

jacquesm3• 11 years ago

If you can seed it then it is not a true random number generator but a pseudo random number generator.

Also the rdseed instruction does not allow you to seed the generator but instead allows you to generate seeds for other (pseudo random) generators.

stephencanon• 11 years ago

RDSEED does not let you seed the RDRAND generator. It provides random data intended for seeding a software PRNG.

https://software.intel.com/en-us/blogs/2012/11/17/the-differ...

caf• 11 years ago

RDSEED is not for seeding the generator, it also reads a random number. The difference is that RDSEED reads directly from the hardware random bit generator whereas RDRAND reads from a CSPRNG itself seeded by that random source.

userbinator• 11 years ago

The problem is that it is a black box.

So is this one... it's also closed-source hardware.

DanBC2• 11 years ago

They have. https://software.intel.com/en-us/articles/intel-digital-rand...

Some people were against it; others not so much.

http://en.wikipedia.org/wiki/RdRand

http://arstechnica.com/security/2013/12/we-cannot-trust-inte...

throwaway7767• 11 years ago

I don't think anyone was really against intel bundling an RNG on-chip. The issue was that they really wanted the OSs to use the entropy gained there directly, rather than just using it as one more source of entropy mixed into the pool.

By doing that, all the security of the system is dependent on Intel's RNG. There's not really any downside to mixing this in with other sources of entropy, even if RDRAND were backdoored, rdrand XOR other_entropy should be equally secure as other_entropy.

spydum• 11 years ago

it's not something that is easy to generate mathematically, so it's an illogical thing to solve for on a cpu, which wants to follow instructions. randomness shouldnt have a "rule" to follow, that ends up being pseudorandom.

See here for a simpler explanation of building a random sequence generator using avalanche effect (sort of the precursor to this device I'd guess): http://holdenc.altervista.org/avalanche/

pjc50• 11 years ago

a) Chip designers prefer to keep analog and digital very separate. Analog takes up comparatively much more space. Putting it on the same die may make side-channel attacks easier.

b) How do you verify that it's really random and not a CSPRNG with a key known to the NSA?

late2part• 11 years ago

I used this before and it worked great - but it is more pricy than tindie....

https://ssl.araneus.fi/products/alea2/order/en/

blkhawk2• 11 years ago

that american flag on the label makes the whole device suspect to me.

acqq3• 11 years ago

If you go that route, the state in which the company is situated is even more interesting.

The site of the producers, though:

http://ubld.it/

Looks like somebody who actually honestly likes to make his own hardware, and not only RNGs.

TranceMan2• 11 years ago

[As a non American] Why?

jameskozart• 11 years ago

to expensive for only random number generator for $50

danbruc2• 11 years ago

A random number generator with US flag on it. Yes, it is kind of silly, it is just a sticker, but it subconsciously evokes negative associations, at least for me.

JonFish852• 11 years ago

What sticker would make you feel better? China? Hungary? Designed in USA, made in China?

smcl3• 11 years ago

No flag whatsoever, really.

Though exploring that tangent a little, I wonder if there is a any sort of study on flags\countries and their association with quality (specifically engineering\tech). Off the top of my head I'd guess people associate places like Sweden, Germany, Switzerland, Austria - I'm not sure why.

danbruc2• 11 years ago

A country is way to broad, you would have to put stickers of people or organizations with good reputation with regard to security on it, say Bruce Schneier or the EFF. But actually you should not do this either because you may evoke a false sense of security.

jisaw• 11 years ago

A truly random flag

DanBC2• 11 years ago

The flag is definitely a bit weird.

Any flag is a bit weird.

This company is going to lose sales for something as trivial as a flag on an easily removable sticker.

I'm sometimes surprised to see HN - which freaking loves AB testing the colour of signup buttons - is resistant to people saying "I dislike this minor detail".

There should be a way for HN users to point out things they dislike about a product - politely, constructively, without undue negativity, and without derailing the thread with off-topic noodling about the website (unless the website is the product).

elcct• 11 years ago

ganja leaf sticker

sago2• 11 years ago

And an italian web address. I thought the juxtaposition was rather amusing.

bliti2• 11 years ago

The flag is part of the marketing. Every other product they sell (boards) has a "Designed in the USA" text printed somewhere. Seems that they believe that having a product "Designed in the USA" gives it more credibility. One interesting point is that they do not mention where the products are actually made. With Tindie (and %99 of other) vendors, you are safe to assume that they are made in china. If not sourced in china and re-sold (which I have no issues with). Now, a RNG with an American flag that was assembled in China does remind me of those USA flags that have the little gold "Made in China" sticker. Would I buy this? Only to play with it on an old air gapped machine.

ljk• 11 years ago

totally personal opinion here, but a lot of the stuff that say "made in the USA" are aimed toward a different crowd(older generation) than this product..

ableal• 11 years ago

Nicely documented. I wanted to be reminded of what a bitmap picture for a PRNG bitstream looks like, and found this example: https://www.random.org/analysis/randbitmap-wamp.png

(bad due to visible patterns, compared to the shown picture for their hardware generator: http://ubld.it/wp-content/uploads/2014/02/random_bitmap.png )

Curiously, the shop shows sales data:

    376 orders / 22 reviews
    Since Mar 04, 2014

(as of about 14h WEST, 2015.05.22, let's see if it budges ;-)

CHY872• 11 years ago

Be aware that a decent prng will look just like the true one. That one's particularly crap. The Mersenne Twisters have incredibly long periods (2^19937 - 1 common) and you won't see anything. These are not at all cryptographically secure.

mbq• 11 years ago

Pretty auditable alternative for $35 https://www.tindie.com/products/WaywardGeek/infinite-noise

benmanns• 11 years ago

If this pool is depleted then the kernel will block causing a delay until the kernel can provide the requested random numbers.

Is there a way to measure how often this happens and what kind of improvements would be expected after buying a hardware RNG?

kseistrup3• 11 years ago

What happened to EntropyKey? http://www.entropykey.co.uk/

msisk6• 11 years ago

Not sure. I got an Entropy Key from Simtec about 4 years ago.

The case of the TrueRNG looks identical to the Entropy Key, but for all I know that could just be a common part.

kseistrup3• 11 years ago

Yeah, me too. So I was surpirsed that their website no longer seems to be available.

hga• 11 years ago

They used up the devices they'd had manufactured, were saying they had no idea if and when they'd have more ... and I guess they've completely given up, now.

kseistrup3• 11 years ago

Thanks.

dTal• 11 years ago

So... they exhausted their entropy pool?

Arjuna• 11 years ago

If you enjoy this topic, you might be interested in HotBits. It uses a Caesium-137 check source and a radiation monitor to generate non-deterministic values.

https://www.fourmilab.ch/hotbits/hardware3.html

JustSomeNobody• 11 years ago

Slightly OT but, didn't, back in the day, some PC sound cards have a white noise generator that one could use for random numbers?

linker3000• 11 years ago

Heck, the Commodore 64 had one in the SID chip - I used to use it for random numbers.

http://www.atarimagazines.com/compute/issue72/random_numbers...

qrmn2• 11 years ago

Just to be clear, the SID's noise generator is NOT a TRNG - it's a XOR shift register, basically an LFSR with no 1-tap. It's predictable.

feld• 11 years ago

Do these work on FreeBSD?

yuvadam• 11 years ago

Sounds pretty fucking expensive.

You can get a $10 RTL-SDR [1] dongle that happily churns out over 2MSp/s and feed random radio noise to your entropy pool using rtl_entropy [2].

Also what's up with the flag, 'murica?

[1] http://sdr.osmocom.org/trac/wiki/rtl-sdr

[2] https://github.com/pwarren/rtl-entropy

nutate• 11 years ago

That's kinda neat thanks!

acqq3• 11 years ago

Very nice, on [2] are the instructions:

"If you're serious about the cryptographic security of your entropy source, you should probably short, or put a 50 Ohm load on the antenna port, and put the whole assembly in a shielded box. Then you're getting entropy from the thermal noise of the amplifiers which is much harder to interfere with than atmospheric radio."

But where do you find $10 dongles? I've found just NooElec NESDR XTR for $50? Edit: OK, there are cheaper dongles with RTL2832U, just not with E4000

Someone1234• 11 years ago

They're selling a $50 "product." You've linked to a $10 experiment. Just the fact that theirs comes with a signed Windows driver and software Linux support out of the box, justifies every cent of the $40.

This complaint is akin to people who complain "a $700 iPhone only has $150 of parts." It might be true, but it ignores the entire development cost, value add, and ease of use relative to buying a box of bolts and building an iPhone (or in this case a RND source).

Their price is very reasonable, and your $10 alternative is not a realistic alternative.

__sbrk• 11 years ago

I hope they've run DIEHARD or similar against this source to check for deterministic flaws:

http://csrc.nist.gov/groups/ST/toolkit/rng/batteries_stats_t...

drewhk• 11 years ago

... or TestU01 Big Crush (https://en.wikipedia.org/wiki/TestU01)

Titanous• 11 years ago

OneRNG is basically the same thing, except it's open hardware: http://onerng.info/

jimhefferon• 11 years ago

They will be ready by April 2015. I can't wait!

benjarrell• 11 years ago

So, a month ago?

jacquesm3• 11 years ago

Beware of single junction devices, if that should ever fail and not be detected then you're in a world of trouble.

mistercow• 11 years ago

Showing the random stream as a bitmap shows no visible patterns like a pseudo random number generator will

Huh? Some PRNGs sure, but I don't really know what this is trying to prove. The output of any decent stream cipher will appear just as random.

jacquesm3• 11 years ago

Sometimes if you start varying the output width of such a process dynamically you can pick out patterns. Not saying this is the case here but it's an interesting trick to allow your visual cortex to do some pretty heavy numerical lifting.

kozak• 11 years ago

The "random bitmap" got somehow compressed by the PNG format by 50% :)

joshguthrie• 11 years ago

Last I heard, there was a free Quantum Random Number Generator with an API out there: http://photonics.anu.edu.au/qoptics/Research/qrng.php

Shameless self-insert: https://github.com/joshleaves/node-qrand

ubldit• 11 years ago

Thank you all for the feedback and also the entertainment. Here's a memorial weekend coupon code for $10 off your purchase of a TrueRNG from Amazon: MERICA10

http://www.amazon.com/TrueRNG-Hardware-Random-Number-Generat...

True hardware random number generator for $50

Related Stories