Hardware Random Bit Generator
web.jfet.org
web.jfet.org
To be pedantic, I think you mean good source of entropy, rather than random data. The raw ADC data is likely to have statistic (Gaussian) bias, which would mean trouble if randomness in the crypto sense were the objective. Ie. you would need to whiten the bitstream (using some kind of hash) to make it useful in a (P)RNG.
But nevertheless, a great idea to start with: cheap and relatively reliable.
It might have. There are also various ways of affecting the spectrum of the noise generated by the transistor using electromagnetic and thermal influence. But can you can positively discern that output as absolutely biased or affected, and crucially would you be able to take actual advantage of it? I'm not really certain, but for this type of solution I'd still err on the side of it not being a feasible attack.
I sell OneRNGs (currently out of stock more coming soon) that use a version of it, however SMT 2N3904s have been EOL'd, next generation will need to use something different (probably a zener)
The Zener diodes are designed so that avalanche breakdown happens in a controlled location, in the bulk of the silicon crystal, so it can be sustained for decades without any changes in behavior.
The avalanche breakdown of the emitter junction of most bipolar transistors is not a controlled mode of operation and it happens in some random location, normally at the external surface of the silicon crystal.
While a Zener diode is designed so that the avalanche current is spread over a large area, to avoid local overheating, in the bipolar transistor the avalanche current may become concentrated in a very small spot, so that the current density can become very high, despite the fact that the current is limited to a very small value by the external resistor.
The small spot where the current is concentrated can become very hot, even up to causing the melting of the crystal. The initial avalanche path may become either insulating or equivalent with a resistor with a very high value in parallel with the junction.
Then the avalanche breakdown will move to another spot on the periphery of the emitter junction, and the cycle will repeat.
This leads to slow fluctuations in the breakdown voltage of the transistor emitter junction and in the amplitude of the noise during the lifetime of the device, which leads to a time-dependent statistical bias of the random bits.
In rare cases, after a long time of use, the reverse-biased emitter junction can become completely resistive, in which case it will still generate thermal noise, but this noise has a lower amplitude than the initial avalanche noise. If the amplifier does not have a gain high enough, the noise may become unable to flip the output gate most of the time, leading to a strong bias in the output.
If the hardware random bits are used only as an input to a secure hash function, then the not-ideal properties of the hardware RNG should not influence the output, as long as the bias of the random bits does not become so extreme as to cause a non-negligible probability of identical bit strings occurring as inputs to the hash.
Also, the schematic with 74ALS04 is quite dated, as such legacy integrated circuits, which have not been used for many decades in new designs, may be hard to find.
If 74ALS04 would be replaced with modern ICs, some changes would be necessary.
Reproducing the schematic with equivalent CMOS gates is dangerous, because the CMOS gates biased into the linear mode of operation have a very high power consumption and they may latch-up, short-circuiting the power supply.
There are many ICs with multiple fast operational amplifiers in a package, which are better suited and safer for the amplifier stages.
Also using a standard CMOS gate at the output would be dangerous. It is much safer to use a Schmitt-trigger gate. Such Schmitt-trigger gates can be found in packages with a single gate that are no bigger than a transistor.
If the noise generator would be used with a microcontroller, then the output gate would normally not be needed, because most microcontrollers have Schmitt-trigger inputs on their GPIO pins.
But how exactly "using a standard CMOS gate at the output would be dangerous"? Because of not providing good zeros an ones, with sharp fronts? High power consumption?
I also do not remember that microcontrollers datasheet explicitly specfied that inputs a Schmitt-triggered. The may be, but I have vague recollection of AVR 90S2313 consuming more than needed power when fed with analog signal on a digital pin.
The output of the noise amplifier is quick aperiodic oscillation centered on a value that is not a valid logic level. There is no guarantee about how fast will be the transition times between the logic low and high levels.
For a gate with Schmitt-trigger input, it does not matter whether the inputs have valid logic levels or not.
On the other hand, for any standard CMOS logic gate, there is a maximum time during which the input is allowed to be not valid. If that maximum time is exceeded, then there are no guarantees about the power consumption of the gate and there are no guarantees that latch-up (an internal thyristor short-circuiting the power supply) cannot happen (in normal operation, only one of the two transistors of a CMOS inverter is on, while the other is off, so only leakage currents are consumed; when the input is invalid, both transistors are on and an unpredictable current passes through them; the time while the input is invalid must be limited, so that the transistors will not overheat).
Of course you may be lucky and nothing wrong will happen when a certain CMOS gate will have an invalid logic level at input. However, such a schematic would never be acceptable for a product made in large quantities, because it is unpredictable how many will fail and when they will fail. Moreover, if such a schematic would be used with a power supply that does not have overcurrent protection, it could even be a safety hazard.
The older bipolar gates like 74ALS04 do not have this problem, but their more modern replacements, like 74HC04 or 74LVC04, must be used as in their specifications, they are much less forgiving of being used in undocumented ways.
Well, the earliest quoted article is from 1995 :)
Can't you use the MMBT3904? DigiKey has several active suppliers of that (in SOT-23, as well as other packages).
Another option: characterize a bunch of different vendors, then selectively populate resistors for proper biasing based on test results from each vendor.
What are you tuning? The bias resistor?
Edit: wow you can do even better than I thought. You could get 30k MMBTs for $500!!
https://www.digikey.com/en/products/detail/diodes-incorporat...
If you're making small runs buying a reel that doesn't work is a risk, I've already made the decision to switch to using a zener for the next production run
Happy to show you what I mean with a quick sch sample if you give me a contact email. My email is the same as my username but at Gmail.
Only mention this because:
- MMBTs are dirt cheap,
- they’re even cheaper when you buy at qty, and your device uses three, whereas you’d only have a single zener and single MMBT otherwise.
End of the day, though - your board, your design, your decision.
Given the feedback nature of the circuit I assume it's sensitive to all kinds of device-specific limitations like slew rate and so on, so hard to get a realistic simulation.
I have one somewhere, let me dig it out (it of course won't produce true randomness since it's a sim, but close enough to understand how the circuit works, which happens to be the closest I've seen to actual recursion in analog electronics).
There are much better and stabler ways to generate noise with analog circuits
. FPGA based inverting gates ring oscillator, which when sampled with a proper crystal-based clock produce noise because the ring oscillator phase-drifts
. thermal noise in a tiny resistor, amplified, the method used by intel chips for their built-in hw gen instruction
. infinite rng, mentioned elsewhere in the thread
. this one (NSFW, the author is weird, but the circuit is interesting, uses comparator hysteresis instability):
http://nosuchlabs.com/fg/fg.png
http://nosuchlabs.com/fg/trng_tw.png
Also note: the fabled von neumann method to uniformize the output has one giant drawback: you lose any guarantee of sustained bandwidth.
Also, also note: however crappy the quality of the bitstream generated, using it to regularly seed a crypto hard hashing algorithm will give you very uniform and practically unguessable stream of random bits, way better than the von neumann thing.
Here's a compendium of HWRNGs:
One source is a ring oscillator, internal to the Betrusted FPGA. The other is an avalanche noise source similar to OP, external to the FPGA.
The two streams are XOR'd and then run through a cryptographic hash.
https://github.com/betrusted-io/betrusted-wiki/wiki/TRNG-cha...
https://github.com/betrusted-io/betrusted-wiki/wiki/TRNG-Dat...
Americium-241, the active component in smoke directors, has a half-life of 432 years, so it should be possible to build inexpensive hardware devices capable of generating a stream of true random numbers that probably could be designed meet all the statistical requirements needed for cryptographic seeds. It's surprising that something like this isn't available; it could be a standard on-board component or packaged into a usb device.
We put up with it in smoke detectors because house fires are more scary than the radiation, but I don't see why you'd want even the tiny extra risk of the thing getting somehow broken or burnt in an illegal recycling fire or something, just for random numbers.
Maybe you could do a safe version that used a banana as the radioactive element, it would make enough entropy to seed a RNG.
The larger issue is that these are not really needed, any device that does something useful (ie. interacts with the outside world) and retains some kind of non-volatile internal state is perfectly capable of generating cryptographic randomness purely in software.
Cryptography is a munition (in the US).
https://en.wikipedia.org/wiki/Export_of_cryptography_from_th...
That might explain the non-ubiquity of convenient random number generator hardware under a hypothesis that widespread use would make signals intelligence much more difficult for three letter agencies.
YMMV.
The three letter agencies have repeatedly expressed an interest in backdoored encryption over the past four decades.
Your inkjet printer encodes thumbprints. Your laser printer won’t replicate currency. They are still good enough for ordinary use cases.
I don’t think cryptography is any different. It’s fine by me if you disagree.
My view is based on the opinion that failure to subvert cryptography would be professional incompetence and the three letter agencies are full of competent professionals with deep motivations like patriotism and better funded than everyone else. YMMV.
For me, it is not a question of computer science.
It is a matter of practical engineering for manufacturing and distribution in a the context of reified political interests.
Cryptography is a munition. All the technical details of current common methods are shaped by that fact or alternatively the military-industrial complex has given up its interest in controlling it.
I never saw a press conference announcing the latter. If I saw one, that’s when I would put on my tinfoil hat…maybe Devo style flowerpot?
If the crypto algorithms are broken it doesn't matter if the RNG is good, without good crypto there's not much you can do with randomness except OTP.
How is the true randomness of a physical phenomenon proved? Perhaps naively, I imagine that as an arithmetic-based software RNG is deterministic, so is a physical RNG, as otherwise the underlying physical process would be governed by no physical principals, no? Does random in this case not necessarily mean non-deterministic, but rather no statistically visible correlations?
In fact everything you observe is truly random, it's just that for most things the probabilities are very boring, at least as far as you can practically tell.
He got caught because the first time he and his accomplice tested their rig out in Atlantic city they hit an astronomical odds jackpot (something like 14 of of 15 numbers).
I think +18V is enough for some quantum physics to happen and suck an electron through the first transistor even though no current is "supposed" to flow, and because it's coming from the base, that turns the second transistor "on" a little bit and "tries" to "brown out" the second transistor's collector causing the voltage at the first capacitor to drop.
This is where I get very lost and confused, because to me if you're trying to enhance the "brownout" to 5V, why in the world would you put a capacitor there?
I know the capacitor not connected to ground is called "AC coupling" and it somehow passes high frequencies but not low ones or something like that, but I don't really understand it at all. It's really hard for me to understand how putting a large capacitor near such a tiny signal doesn't simply cause that signal to get lost in the capacitor's ocean of capacity for absorbing electrons.
Then I tried to look at what the 74AL304 is doing, it's apparently a standard inverter, but I think it's trying to be used in an "analog" way here. The inverter is "trying" to calculate "A = ~A" but since the connection from input to output is a resistor, you can't think in digital terms and you have to look at its analog characteristics.
I found a datasheet on TI's website but it doesn't have much information about its analog behavior, I'm thinking that to begin to understand what it does, I'd need a voltage sweep curve or a diagram of the internal transistors of the 74ALS04.
My intuition is that the electric force is really strong, so when an electron comes onto one side of the capacitor, it forces an electron off the other side, so if you black-box the capacitor, it "acts like a wire": Current that goes in one side comes out the other side. (I'll run with this for this post, but now I have another unanswered question, "Okay then, if electron in side A = electron out side B, how is a capacitor different from a wire?")
So the 74ALS04 is "trying" to raise its output when the input is low, and lower its output when the input is high. Therefore if you sweep the input voltage, at some point it must switch from "trying" to raise, and begin "trying" to lower. By connecting output and input, a too-low or too-high voltage drives the inverter toward the crossover point, and forces it to stay there.
Now if you suddenly force an electron into the input of the inverter, it has to react by sending the output in the opposite direction. The circuit designer seems to have assumed this occurs in an amplifying way, at least in this circuit.
It's still very confusing for me to imagine the input and output of the inverter at different voltages, because then current is flowing through the resistor, but where does that current go? Maybe it goes back into the capacitor?
Okay, so a tiny voltage drop at the inverter's input causes it to surge current to its output. A tiny amount of the surge goes back through the 27K resistor which eventually raises the input voltage so the surge shuts itself down, but most of the surge goes through the low-resistance path and flows into the next stage's capacitor (how many stages you need depends on the amplification factor vs. how small the input signal is), then after the two stages you have a final "normal" inverter gate cleans up the signal so you have a digital output.
I still don't understand AC coupling. Anyone care to take a crack at explaining why the capacitors are necessary, and what happens if you replace them with wires?