[HN Gopher] Hardware Random Bit Generator
___________________________________________________________________
Hardware Random Bit Generator
Author : Tomte
Score : 82 points
Date : 2023-09-04 08:38 UTC (14 hours ago)
(HTM) web link (web.jfet.org)
(TXT) w3m dump (web.jfet.org)
| ooterness wrote:
| Bunnie Hwang's "Betrusted" project uses a pair of circuits as an
| entropy source, with a few blog posts describing the how and why
| of the design.
|
| One source is a ring oscillator, internal to the Betrusted FPGA.
| The other is an avalanche noise source similar to OP, external to
| the FPGA.
|
| The two streams are XOR'd and then run through a cryptographic
| hash.
|
| https://github.com/betrusted-io/betrusted-wiki/wiki/TRNG-cha...
|
| https://github.com/betrusted-io/betrusted-wiki/wiki/TRNG-Dat...
| SomeoneFromCA wrote:
| That poor emitter-upside-down BJT will degrade quickly and won't
| be fit to be used for normal amplification purposes - noise
| increases, hFE will go down and all kind of bad things will
| happen to it. So if you are planning to experiment with it, do
| not reuse that BJT for analog purposes.
| ur-whale wrote:
| Worse : the quality pf the HW RNG will degrade steadily over
| time.
|
| There are much better and stabler ways to generate noise with
| analog circuits . FPGA based inverting gates
| ring oscillator, which when sampled with a proper crystal-based
| clock produce noise because the ring oscillator phase-drifts
| . thermal noise in a tiny resistor, amplified, the method used
| by intel chips for their built-in hw gen instruction
| . infinite rng, mentioned elsewhere in the thread
| . this one (NSFW, the author is weird, but the circuit is
| interesting, uses comparator hysteresis instability):
| http://nosuchlabs.com/fg/fg.png
| http://nosuchlabs.com/fg/trng_tw.png
|
| Note that many of these RNG produce very crappy random numbers
| from a uniformity perspective (distribution is rarely uniform).
|
| Also note: the fabled von neumann method to uniformize the
| output has one _giant_ drawback: you lose any guarantee of
| sustained bandwidth.
|
| Also, also note: however crappy the quality of the bitstream
| generated, using it to regularly seed a crypto hard hashing
| algorithm will give you very uniform and practically
| unguessable stream of random bits, way better than the von
| neumann thing.
|
| Here's a compendium of HWRNGs:
|
| https://github.com/atoponce/awesome-hwrng
| photochemsyn wrote:
| > "People talk about using radioactive sources, and that probably
| gives better randomness, but a more practical approach is to use
| noise from a reverse-biased PN junction."
|
| Americium-241, the active component in smoke directors, has a
| half-life of 432 years, so it should be possible to build
| inexpensive hardware devices capable of generating a stream of
| true random numbers that probably could be designed meet all the
| statistical requirements needed for cryptographic seeds. It's
| surprising that something like this isn't available; it could be
| a standard on-board component or packaged into a usb device.
| loeg wrote:
| No one needs a random source that meets statistical properties
| unfiltered; you just need something good enough that can be
| filtered, compressed, and distilled into a few unpredictable
| bits. 256-512 high quality bits are enough to seed everything
| else for an indefinite period of time. If your random source
| only has ~0.1 bit-per-byte of entropy but can produce 30,000
| biased bits quickly, that's enough to seed the system.
|
| https://blog.cr.yp.to/20170723-random.html
| brudgers wrote:
| _It 's surprising that something like this isn't available_
|
| Cryptography is a munition (in the US).
|
| https://en.wikipedia.org/wiki/Export_of_cryptography_from_th...
|
| That might explain the non-ubiquity of convenient random number
| generator hardware under a hypothesis that widespread use would
| make signals intelligence much more difficult for three letter
| agencies.
|
| YMMV.
| tptacek wrote:
| It would do no such thing. Commodity computing devices are
| plenty capable of generating key material without specialized
| circuitry.
| brudgers wrote:
| The military-industrial complex provides solutions suited
| for the military-industrial complex's interests.
|
| The three letter agencies have repeatedly expressed an
| interest in backdoored encryption over the past four
| decades.
|
| Your inkjet printer encodes thumbprints. Your laser printer
| won't replicate currency. They are still good enough for
| ordinary use cases.
|
| I don't think cryptography is any different. It's fine by
| me if you disagree.
|
| My view is based on the opinion that failure to subvert
| cryptography would be professional incompetence and the
| three letter agencies are full of competent professionals
| with deep motivations like patriotism and better funded
| than everyone else. YMMV.
| tptacek wrote:
| I'm fine with your beliefs about the trustworthiness of
| authorities, the IC, whatever. My problem with attempts
| to extend those beliefs axiomatically into computer
| science, where they don't hold. The IC's desire to
| subvert random number generation isn't a point I'd argue.
| Let's just stipulate that it's true. The process you're
| describing of accomplishing that, of preventing the
| distribution of random number generating circuits,
| doesn't work. That's not how random bit generation works
| in modern cryptosystems.
| brudgers wrote:
| https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_
| Ref...
|
| For me, it is not a question of computer science.
|
| It is a matter of practical engineering for manufacturing
| and distribution in a the context of reified political
| interests.
|
| Cryptography is a munition. All the technical details of
| current common methods are shaped by that fact or
| alternatively the military-industrial complex has given
| up its interest in controlling it.
|
| I never saw a press conference announcing the latter. If
| I saw one, that's when I would put on my tinfoil
| hat...maybe Devo style flowerpot?
| dfox wrote:
| Many contemporary computing platforms have some kind of HW RNG
| built into them, these are often regarded with some kind of
| skepticism as they are not really auditable.
|
| The larger issue is that these are not really needed, any
| device that does something useful (ie. interacts with the
| outside world) and retains some kind of non-volatile internal
| state is perfectly capable of generating cryptographic
| randomness purely in software.
| daneel_w wrote:
| I came up with the same idea when I was 15 years old around the
| mid-90s, but for an entirely different purpose. I had an interest
| in electronics and analog synthesizers and I was trying to figure
| out a way to replicate the Commodore 64's audio chip's
| (https://en.wikipedia.org/wiki/MOS_Technology_6581) ability to
| produce unfiltered noise of any audio frequency - something else
| than just low-pass-filtering white noise to get pink and brown
| etc. noise - and it struck me that running white noise from a
| transistor wired in reverse through a tunable sample-and-hold
| circuit would produce the desired result. Years later it dawned
| on me that it would also be a good source of random data if it at
| a suitable frequency was fed through an ADC.
| pipo234 wrote:
| > Years later it dawned on me that it would also be a good
| source of random data if it at a suitable frequency was fed
| through an ADC.
|
| To be pedantic, I think you mean good source of _entropy_ ,
| rather than _random data_. The raw ADC data is likely to have
| statistic (Gaussian) bias, which would mean trouble if
| randomness in the crypto sense were the objective. Ie. you
| would need to whiten the bitstream (using some kind of hash) to
| make it useful in a (P)RNG.
|
| But nevertheless, a great idea to start with: cheap and
| relatively reliable.
| dahart wrote:
| It's okay for people to use the word "random" without meaning
| secure cryptographic randomness, even in a technical setting.
| To be pedantic myself, the word "random" has many legitimate
| meanings, so we don't need to impose the most strict version
| of our favorite term of art on people any time an overloaded
| word is used, right? It's fine to ask or point out or discuss
| the nuance, but saying "I think you mean X" is likely to be
| an incorrect assumption, no?
| daneel_w wrote:
| _> "To be pedantic, I think you mean good source of entropy,
| rather than random data. The raw ADC data is likely to have
| statistic (Gaussian) bias ..."_
|
| It _might_ have. There are also various ways of affecting the
| spectrum of the noise generated by the transistor using
| electromagnetic and thermal influence. But can you can
| positively discern that output as absolutely biased or
| affected, and crucially would you be able to take actual
| advantage of it? I 'm not really certain, but for this type
| of solution I'd still err on the side of it not being a
| feasible attack.
| thinkski wrote:
| From the article: "To get a TRULY random number sequence, you'd
| need to rely upon some truly random phenomenon, like the decay of
| a radioactive isotope."
|
| How is the true randomness of a physical phenomenon proved?
| Perhaps naively, I imagine that as an arithmetic-based software
| RNG is deterministic, so is a physical RNG, as otherwise the
| underlying physical process would be governed by no physical
| principals, no? Does random in this case not necessarily mean
| non-deterministic, but rather no statistically visible
| correlations?
| H8crilA wrote:
| Quantum mechanics, and the specific proof is the subject of a
| recent Nobel prize (practical demonstration of a violation of a
| Bell's inequality). Shame that Bell himself didn't live long
| enough to get the prize too.
|
| In fact everything you observe is truly random, it's just that
| for most things the probabilities are very boring, at least as
| far as you can practically tell.
| dchest wrote:
| https://physics.stackexchange.com/questions/340530/how-do-we...
| vbezhenar wrote:
| I thought about connecting headphones and mic in a way, so mic
| will catch headphones sound and amplify it (you know this
| terrible sound). I feel like it should contain some randomness,
| so might be an "low budget" option for those of us who can't
| distinguish resistor from transistor.
| dale_glass wrote:
| That's feedback and it's very much not random. These days there
| are audio tools that automatically eliminate it, which wouldn't
| be possible if it was random.
| goalieca wrote:
| To be pedantic, noise removal works great if you know the
| signal, but still works great if you model it as a
| statistical distribution.
| picture wrote:
| Also see Infinite Noise TRNG
| https://github.com/waywardgeek/infnoise
| magicalhippo wrote:
| Tried simulating this circuit in LTSpice and failed miserably.
| Anyone got a working circuit to share?
|
| Given the feedback nature of the circuit I assume it's
| sensitive to all kinds of device-specific limitations like slew
| rate and so on, so hard to get a realistic simulation.
| ur-whale wrote:
| > Tried simulating this circuit in LTSpice and failed
| miserably
|
| I have one somewhere, let me dig it out (it of course won't
| produce true randomness since it's a sim, but close enough to
| understand how the circuit works, which happens to be the
| closest I've seen to actual recursion in analog electronics).
|
| Here: https://github.com/threeTB1rao/infrng-ltspice
| magicalhippo wrote:
| Awesome, thanks!
| cumshitpiss wrote:
| [dead]
| Taniwha wrote:
| This circuit is just about the standard one that everyone has
| used for decades (weirdly biased 2N3904s to make an avalanche
| diode)
|
| I sell OneRNGs (currently out of stock more coming soon) that use
| a version of it, however SMT 2N3904s have been EOL'd, next
| generation will need to use something different (probably a
| zener)
| magicalhippo wrote:
| > however SMT 2N3904s have been EOL'd
|
| Can't you use the MMBT3904? DigiKey has several active
| suppliers of that (in SOT-23, as well as other packages).
| Taniwha wrote:
| ah hadn't noticed those - the big problem with this circuit
| is that if need to need to be able manufacture something it
| needs to be reliably repeatable - I've found I need to buy a
| reel made by a particular manufacturer and tweek the circuit
| just so.
| cushychicken wrote:
| A roll of 5k MMBTs from a sole source would probably cost
| you less than $500 if you looked around a bit.
|
| Another option: characterize a bunch of different vendors,
| then selectively populate resistors for proper biasing
| based on test results from each vendor.
|
| What are you tuning? The bias resistor?
|
| Edit: wow you can do even better than I thought. You could
| get 30k MMBTs for $500!!
|
| https://www.digikey.com/en/products/detail/diodes-
| incorporat...
| Taniwha wrote:
| I tune the bias on the output stage (another 2N3094) -
| the goal is to get ~50% 1/0 when sampling - note that
| there's a software time domain filter in there as well -
| we're measuring after that.
|
| If you're making small runs buying a reel that doesn't
| work is a risk, I've already made the decision to switch
| to using a zener for the next production run
| magicalhippo wrote:
| Ah I guess the manufacturing-dependent parasitics plays a
| role, given the floating base and such. Fortunately they're
| quite cheap tho :)
| adrian_b wrote:
| An actual Zener diode is preferable to an avalanche breakdown
| diode improvised from a bipolar transistor.
|
| The Zener diodes are designed so that avalanche breakdown
| happens in a controlled location, in the bulk of the silicon
| crystal, so it can be sustained for decades without any changes
| in behavior.
|
| The avalanche breakdown of the emitter junction of most bipolar
| transistors is not a controlled mode of operation and it
| happens in some random location, normally at the external
| surface of the silicon crystal.
|
| While a Zener diode is designed so that the avalanche current
| is spread over a large area, to avoid local overheating, in the
| bipolar transistor the avalanche current may become
| concentrated in a very small spot, so that the current density
| can become very high, despite the fact that the current is
| limited to a very small value by the external resistor.
|
| The small spot where the current is concentrated can become
| very hot, even up to causing the melting of the crystal. The
| initial avalanche path may become either insulating or
| equivalent with a resistor with a very high value in parallel
| with the junction.
|
| Then the avalanche breakdown will move to another spot on the
| periphery of the emitter junction, and the cycle will repeat.
|
| This leads to slow fluctuations in the breakdown voltage of the
| transistor emitter junction and in the amplitude of the noise
| during the lifetime of the device, which leads to a time-
| dependent statistical bias of the random bits.
|
| In rare cases, after a long time of use, the reverse-biased
| emitter junction can become completely resistive, in which case
| it will still generate thermal noise, but this noise has a
| lower amplitude than the initial avalanche noise. If the
| amplifier does not have a gain high enough, the noise may
| become unable to flip the output gate most of the time, leading
| to a strong bias in the output.
|
| If the hardware random bits are used only as an input to a
| secure hash function, then the not-ideal properties of the
| hardware RNG should not influence the output, as long as the
| bias of the random bits does not become so extreme as to cause
| a non-negligible probability of identical bit strings occurring
| as inputs to the hash.
|
| Also, the schematic with 74ALS04 is quite dated, as such legacy
| integrated circuits, which have not been used for many decades
| in new designs, may be hard to find.
|
| If 74ALS04 would be replaced with modern ICs, some changes
| would be necessary.
|
| Reproducing the schematic with equivalent CMOS gates is
| dangerous, because the CMOS gates biased into the linear mode
| of operation have a very high power consumption and they may
| latch-up, short-circuiting the power supply.
|
| There are many ICs with multiple fast operational amplifiers in
| a package, which are better suited and safer for the amplifier
| stages.
|
| Also using a standard CMOS gate at the output would be
| dangerous. It is much safer to use a Schmitt-trigger gate. Such
| Schmitt-trigger gates can be found in packages with a single
| gate that are no bigger than a transistor.
|
| If the noise generator would be used with a microcontroller,
| then the output gate would normally not be needed, because most
| microcontrollers have Schmitt-trigger inputs on their GPIO
| pins.
| SomeoneFromCA wrote:
| Totally agree, it is well known that reverse biasing emitter
| into breakdown will degrade the performance of device.
|
| But how exactly "using a standard CMOS gate at the output
| would be dangerous"? Because of not providing good zeros an
| ones, with sharp fronts? High power consumption?
|
| I also do not remember that microcontrollers datasheet
| explicitly specfied that inputs a Schmitt-triggered. The may
| be, but I have vague recollection of AVR 90S2313 consuming
| more than needed power when fed with analog signal on a
| digital pin.
| adrian_b wrote:
| I do not remember what AVR does. In recent years I have
| used mostly ST microcontrollers and all of them had
| Schmitt-trigger inputs on the GPIOs. Obviously, for any
| microcontroller the datasheet must be checked when a
| schematic is designed.
|
| The output of the noise amplifier is quick aperiodic
| oscillation centered on a value that is not a valid logic
| level. There is no guarantee about how fast will be the
| transition times between the logic low and high levels.
|
| For a gate with Schmitt-trigger input, it does not matter
| whether the inputs have valid logic levels or not.
|
| On the other hand, for any standard CMOS logic gate, there
| is a maximum time during which the input is allowed to be
| not valid. If that maximum time is exceeded, then there are
| no guarantees about the power consumption of the gate and
| there are no guarantees that latch-up (an internal
| thyristor short-circuiting the power supply) cannot happen
| (in normal operation, only one of the two transistors of a
| CMOS inverter is on, while the other is off, so only
| leakage currents are consumed; when the input is invalid,
| both transistors are on and an unpredictable current passes
| through them; the time while the input is invalid must be
| limited, so that the transistors will not overheat).
|
| Of course you may be lucky and nothing wrong will happen
| when a certain CMOS gate will have an invalid logic level
| at input. However, such a schematic would never be
| acceptable for a product made in large quantities, because
| it is unpredictable how many will fail and when they will
| fail. Moreover, if such a schematic would be used with a
| power supply that does not have overcurrent protection, it
| could even be a safety hazard.
|
| The older bipolar gates like 74ALS04 do not have this
| problem, but their more modern replacements, like 74HC04 or
| 74LVC04, must be used as in their specifications, they are
| much less forgiving of being used in undocumented ways.
| sharedbeans wrote:
| I think most commercial chips should not encounter latch-
| up issues even if you bias a GPIO input to mid-rail.
| Taniwha wrote:
| Most chips have input circuits that avoid this and are
| metastability resistant - though arguably some
| metastability is a good thing in an RNG
| mananaysiempre wrote:
| > for decades
|
| Well, the earliest quoted article _is_ from 1995 :)
___________________________________________________________________
(page generated 2023-09-04 23:01 UTC)