Hacker News Reader

Comment by Osmium | Hacker News Reader

Does anyone have a link for a spec for the RNG? Specifically, where does it get its entropy from? Couldn't find it in the source link. Only mention I could find is a vague mention of "thermal noise" which could mean anything.

View on HN

I found the link on Reddit. They're asking similar questions.

So far Reddit hasn't got any answers; someone posted a link to a mailing list. Here's a similar link. (https://lkml.org/lkml/2013/3/24/144)

> This adds a driver for random number generator present on Broadcom BCM2835 SoC, used in Raspberry Pi and Roku 2 devices.

Here's a github for the blob source (https://github.com/raspberrypi/linux/blob/rpi-3.6.y/drivers/...)

It's a frustrating lack of information. :-/

(I posted here partly because of the Intel RdRand stuff the other day, but also RPis are fun and this could be a fun experiment.)

The only use for a binary blob that purports to a be a secure RNG is to feed it to /dev/random.

It isn't a binary blob, it is a blob of hardware gates. The RNG is interfaced with simple MMIO and just four memory mapped registers.

Some of these comments are particularly worrying:

    /* double speed, less random mode */
    #define RNG_RBG2X               0x2
    /* the initial numbers generated are "less random" so will be discarded */
    #define RNG_WARMUP_COUNT      0x40000

A black box random number generator with some numbers being vaguely "less random"? That seems like an exceedingly poor idea.

I'm not sure that's worrying. Remember, this is hardware. Hardware takes time to turn on and get into a steady state. Many hardware random number generators are based on thermal noise. But in order to get in the correct range for the values to flip, you need to wait for the circuit to warm up to operating temperature.

A classic source of white noise is to reverse-bias a diode or the base-emitter junction of a transistor[1]. This produces shot noise[2] though, which is independent of temperature, so I guess it's not what they are using.

[1] http://darrenyates.com.au/electronics/archives/40 [2] http://en.wikipedia.org/wiki/Shot_noise

The SoC datasheet has this to say about the RNG http://pastehtml.com/view/crkxyohmp.rtxt Which is not particularly helpful.

How it works is basically undocumented although I hear the RPi engineers believe it uses some sort of thermal noise as the source for entropy.

Broadcom do have HWRNG patents though...

https://www.google.co.uk/patents/US6748495 https://www.google.co.uk/patents/US8229108

Bah. Both those patents are just basically traditional linear feedback shift register systems, plus some fudging to try and make the results better.

Reply on news.ycombinator.com