An Informal Taxonomy of True Random Number Generators

Home / Next Lesson

Briefly, there are a few broad classes of TRNGs, enumerated in the following table. Enranda belongs to the "ultrahard" category.

Class	Typical Embodiment	Typical Vulns
Broken	A physical system which produces biased bits and outputs them directly as entropy, or perhaps a PRNG implemented in hardware and sold as a TRNG.	The TRNG itself may be hardened, but it doesn't matter because its output is already biased.
Trust-Me-TRNG	CPU "black magic" randomness register, open-source USB device, or a device which measures a nonlinear physical phenomenon (e.g. cosmic microwave background).	Hardware poisoning on the manufacturing floor. Furthermore, the hardware cannot be virtualized (or aliased to alternative hardware) so as to preempt poisoning. Output poisoning in the path connecting the physical randomness source to the output entropy.
Quasiquantum	Comes in a box with a "quantum" sticker on the side. Or perhaps this takes the form of an app which simply extracts quantum noise from the quantum dots that comprise your camera array (CCD). In any event, it claims to produce true random numbers from the fundamental uncertainty of the universe, which is certainly within the realm of what is physically possible.	"It looks quantum to me" does not mean that it is not merely a simulation thereof. Even if we trust the manufacturer, qubits are easily biased by all manner of interference, some of which might be predictable (or worse, inducible) by an attacker within physical proximity. For example, is the quantum dot CCD noise dependent upon lighting conditions? Can the pixel data be read via device emissions as it traverses the IO bus to the CPU? What happens if the camera has hot pixels, which are stuck in a particular configuration? Does that make the output occasionally predictable? Do we really want our cameras turning on at just the moment we need cryptographically hard randomness to protect our privacy anyway? How can this app be trusted to dispose of the captured image frame, rather than send it to some database on the Internet?
Ultrahard	Statistically indistinct from an ideal TRNG by every computable metric. Coldboot attack is futile. Completely open-source code with minimal dependency on hardware which may be entirely virtualized in such a manner that the implementer has full control over which. Cannot be defeated other than by subverting the machine and taking control of its outputs via (possibly nested) virtualization (which even then, would be immensely difficult and sometimes detectable); at which point, there is no reason to care about the TRNG because the machine is rooted and exposed to complete exploitation. Obtaining an exact copy of the machine would be completely useless for the purposes of predicting the output, even if the attacker had a quantum computer of planetary dimensions. In other words, forget it.	The only material vuln here, apart from a lazy security guard who left the door open to the server room, would be a bug in the implementation. For its part, Enranda has been carefully combed for such bugs. Nonetheless bug reports are highly encouraged from the security community, especially when they create security vulns. If you can demonstrate weaknesses in Enranda without subverting the OS, we will regard you as a hero, not a criminal!
Ideal	A theoretical unbiased source of bits.	None.

Intro

For the impatient, source code is here. Nevertheless reading this documentation is strongly encouraged.

Enranda is a true random number generator (TRNG) without any external hardware requirements. If that sounds like a contradiction in terms, recall that my previous such product, Jytter, was exactly that: a TRNG which produced cryptographically hard true random numbers using only the CPU timestamp counter (TSC) as a source of entropy, which can be read from unprivileged (userspace) apps under various modern operating systems (OSes).

But that was 2012. In the intervening 3 years, the generous and incredibly patient sponsorship of Tigerspike has allowed me to pursue, among other things, a much faster and cryptographically simpler TRNG. It is my hope that you will use this product to create better security products for all of us, so that we need not trust third party black boxes ("trust-me-TRNGs") -- or even open source hardware, for that matter, which can suffer from poisoned electronic components at the time of manufacture.

Before getting into the details, you should understand some of the criticisms that have been leveled against Enranda. As with anything else in life, it's a tradeoff between convenience and security. It may or may not be suitable for your particular application. That's your decision and your responsibility to evaluate. Here is the thread on the Randombit cryptography mailing list.

The features of Enranda are outlined below, which are thoroughly expounded in the documentation that follows.

1. Ultrahard (yes, we actually explain that!).

2. Roughly 4 megabytes per second on a commodity laptop.

3. Robust against mistaking autopseudorandomness for genuine physical entropy.

4. Employs realtime filtering of periodic signals which appear entropic but by definition have zero information content.

5. Originally developed for X86 and X64 architectures including Linux, MacOS, and Windows, but portable anywhere that the TSC or its equivalent can be read. (For example, search the source for ABSTIME, which is intended to support ARM but has not been tested.) See README.txt for a comprehensive summary of which environments have been tested.

Following is the table of contents for our comprehensive tutorial. You will find other articles posted to this blog from time to time, but here are the basics:

1. An Informal Taxonomy of True Random Number Generators
2. The Trouble with Timestamps
3. Antiperiodic Countermeasures: Sequence Hashes and Populations Thereof
4. Permutative Trapdoors and History Hashes
5. Statistical Analysis of Enranda's Output
6. Enranda Source Code
7. Enranda Demo Output