Turbid: A High-Entropy Random Generator | Hacker News Reader

Turbid: A High-Entropy Random Generator

av8n.com

32 pointsTomte17 comments

Hardware random number generators tend to attract a lot of interest, but people should be aware that they don't solve any real problem.

Every modern OS has a secure RNG. Except for the problem of early boot time entropy (which you can avoid if you have the right API calls that block before enough entropy has been collected), there's never been any major problem with those. Otherwise the only problems with RNGs are either simple bugs (i.e. you're not really using the secure RNG) or people calling pseudorandom functions that weren't meant to be used for secure use cases.

I thought they were useful for embedded use cases, where there isn't much going on so it can take a long time for the OS to collect enough entropy.

There is still quite a lot going on. Especially in the multi-core scenario.

>Every modern OS has a secure RNG

A strong statement, without much in the way of supporting evidence.

Windows, Mac, IOS, and Linux do. By my count, that's somewhere between 99.5% and 99.9%

BSDs do as well, I believe

Te fact that modern os's have built in RNG is so blatantly obvious, it's clearly not what my comment was about.

Your numbers say strictly nothing about the "secure" part.

People don't really like their random calls to block for an arbitrary amount of time. Using a hardware random number generator to seed your PRNG quickly is a useful thing to have.

Most Intel and AMD CPUs in the last 8 years have had hardware RNGs that are based on shot noise of a reverse biased Zener diode, which is better than whatever thermal noise/RF this resistive setup is picking up.

They have a hardware RNG but it sure isn't based on a reverse biased diode. They claim to be ring oscillator based, though their operation is not independently verifiable.

Their design-- using AES as a whitening postprocessing step-- would make it extremely easy for them to return something like an aes stream based just on a counter and secret key as a result of an almost undetectable attack.

In a way, the system does not guarantee there is no kleptographic attack either since the CPU acts like a black-box device

True enough, though the AES DRBG output based HWRNGs would be a great target-- a highly specific nobus or near nobus attack with just a dopant change breaking a single gate... and then the RNG is just some fixed AES stream known to the attacker.

Good to know, I assumed they'd use the best available:

https://en.wikipedia.org/wiki/Noise_generator

AFAIK you can't just put a reverse bias diode generator in a processor because it requires a different process and relatively high voltages (as ICs go).

> there's never been any major problem with those

Sure there have been, e.g.

CVE-2006-1833, CVE-2008-516, CVE-2013-5180, CVE-2014-4422, https://marc.info/?l=netbsd-current-users&m=136460321709597

... just to give some random examples.

Of course, whatever yolo hwrng people use may be even worse off.

Another hardware random generator that's easier to "get right": Infinite Noise

https://github.com/waywardgeek/infnoise https://www.crowdsupply.com/13-37/infinite-noise-trng

oof the calibration process seems VERY daunting, involving breadboards multimeters and tinfoils. I thought HRNGs were already included in chipsets? doesn't every CPU has it ?

Reply on news.ycombinator.com