High quality entropy with nothing up its sleeves
bitbabbler.org
bitbabbler.org
I recommend copy-pasting the document, deleting all the "myth" garbage, and reading the explanations.
Mere requirement of knowing every execution and failure state in TCB eliminates Linux + /dev/urandom instantly. Some FSM's + some analog circuits can be verified by eye, hand, and formal verification if desired.
Now the certification bodies, paperwork focus, etc can be harmful. It's why I got private evaluations for my stuff. I saw Sentinel do same for HYDRA using NSA and Secure64's SourceT (medium assurance) had positive review from Matasano for its POLA/resilience. And that's COTS. Sirrix too using Nizza architecture with tiny TCB. So, the basic principles are there, improvements are often dramatic, several companies are doing it, and so rest have no technical excuse for using weaker methods.
Also, most people have things they do not need. For example, one doesn't need a tablet, whiskey, or windows in their dwelling.
Do you mean there are any special cases situations where entropy is extremely low? Just after reboot? Just after first install? Just after booting a VM from an image (where the "entropy" could be public knowledge)? Container?
1. Breaking urandom's construction is much less likely than breaking a less-trodden hardware device.
2. If hashes in general are broken, then any crypto of interest is also broken (counter example: non-complexity based crypto like a one-time pad (note: Do NOT construe this as any sort of practical endorsement of "one time pads". If you do not understand the concept of malleability, then forget this entire comment exists and go read up on that instead!)).
3. Backdooring RDRAND is equivalent to backdooring the entire CPU (counter: a model of auditability that constrains the complexity of a backdoor)
These assumptions are mostly reasonable, but they are assumptions nonetheless.
Embedded systems do suffer from a demonstrable lack of entropy. Studying techniques for hardware entropy collection is interesting in its own right, which is why it's disappointing that this page seems more focused on productizing their device as a black box USB stick rather than concentrating on open review.
This device apparently generates reliably a 300 Gbps random stream. Not easy/cheap to do with DRBGs. But as I said, I have no idea of any application where this would be required.
It's too bad they dismiss using radioactive decay for "practical reasons". There's a guy[1] who has been playing with that, off and on, for over 30 years. He's still at it, I just got some fresh random bits from him a few minutes ago. His hardware doesn't seem that expensive.
BTW we just had a discussion on weak RNGs on the web a few days ago: https://news.ycombinator.com/item?id=10030036 As usual with HN, the comments are at least as informative as the article itself.
This http://www.fourmilab.ch/hotbits/statistical_testing/stattest...
is very similar to this http://www.bitbabbler.org/what.html
Of course, that makes sense, right? Both pages are about testing a HW RNG.
This one looked very interesting, and surprisingly cheap and easy to to build.
There's a ubiquitous product, probably 100+ million instances currently operational just in the USA. This product costs about $10 to make. It has both a radioactive source and a way to (indirectly) detect alpha particles.[1]
Yes it's not a perfect analogy. But surely there's a way to build a much cheaper alpha detector?
But, I really like their website. It's full of words. Thousands of them. Carefully chosen words.
"So from this, we have a theoretically strong basis for efficient extraction of good entropy. We have sources of noise which are naturally white and for which the best scientific understanding is that the mechanisms underlying them are subatomic scale events which are as independently random as any kind of physical phenomenon is known to be. We have multiple sources of noise that are not all influenced by the same set of physical or environmental conditions. We have a mechanism to extract it which ensures good mixing over time and is robust against interference from predictable signals, over a wide range for the noise floor mean. We can implement it in a way which makes it obvious that no programmed manipulation of the process output is taking place. It is self stable and doesn't require continuous tuning to operate correctly. And we can clock bits out of it at just about any rate we please up to the effective bandwidth of the circuitry responsible for doing that."
Unless you think Intel might have put some kind of backdoor in it (hard to believe), in which case they could also be intercepting your USB communication with this device and substitute their own evil numbers.
But this is all so silly. So far as computer science currently understands, the modern Linux software CSPRNG on modern Linux distros is perfectly adequate for all crypto.
I'd probably use RDRAND if I could count on having it, and if I was designing my own virtualized cloud hosting environment that was going to run at scale I might spend a few hours figuring out how to provision cold-start seeds to new VMs, but other than that I never think about this stuff. Just use urandom!