I Can’t Sleep - Hardware Random Number Generators | Sleep Reading

Episode Date: June 22, 2022

Unwind with this calm bedtime reading on hardware random number generators, a soothing way to drift into sleep and ease insomnia. Relax as Benjamin gently explores how these devices create randomness using physical processes, from electronic noise to quantum effects, in contrast to software-based methods. His steady, peaceful cadence turns complex technology into calming background learning. No whispering, no hypnosis—just quiet education to ease anxiety, stress, and restless nights. Let curiosity settle your mind while your body prepares for rest. Press play, listen, and peacefully drift away. Want More? Request a Topic: https://www.icantsleeppodcast.com/request-a-topic Ad-Free Episodes: https://icantsleep.supportingcast.fm/ Shop Sleep-Friendly Products: https://www.icantsleeppodcast.com/sponsors Join the Discussion on Discord: https://discord.gg/myhGhVUhn7 This content is derived from the Wikipedia article on Hardware Random Number Generator, available under the Creative Commons Attribution-ShareAlike (CC BY-SA) license. Read the full article: Wikipedia – Hardware Random Number Generator. Happy sleeping! Learn more about your ad choices. Visit megaphone.fm/adchoices

You're listening to a Glassbox media podcast. What if I told you that most of the modern day self-help advice you've been hearing could actually make you worse? The key to a better life isn't about feel-good gimmicks that sound catchy. The Mentally Stronger Podcast gives you access to a licensed therapist who shares science-backed tools that will actually change your life. Hi, I'm Amy Morin, psychotherapist, mental strength trainer, and international best-selling author. In each episode, we cover research-back strategies, like how to stop relying on willpower and start creating habits for lasting change. And the five mental strength-building exercises you can do from your couch.

I also speak to world-class experts like Dr. Nicole Kane, who shares how to permanently heal anxiety by addressing the root cause. With over 200 episodes in our catalog, this podcast is for you if you're ready to crush self-doubt, conquer challenges, and become stronger than ever with therapist-approved strategies that can change your life. Listen to Mentally Stronger with Therapist Amy Morin, wherever you get your podcasts. Welcome to the I Can't Sleep podcast, where I read random articles from across the web to bore you to sleep with my soothing voice. I'm your host, Benjamin Boster. Today's episode is from a Wikipedia article titled Hardware Random Number Generator.

In computing, a hardware random number generator, H-R-N-G, or True Random Number Generator, TRNG, is a device that generates random numbers from a physical process, rather than by means of an algorithm. Such devices are often based on microscopic phenomena that generate low-level, statistically random noise signals, such as thermal noise, the photoelectric effect, involving a beam splitter, and other quantum phenomena. These stochastic processes are in theory completely unpredictable for as long as an equation governing such phenomena is unknown or uncomputable, and the theory's assertions of unpredictability are subject to experimental test. This is in

contrast to the paradigm of pseudo-random number generation commonly implemented in computer programs. A hardware random number generator typically consists of a transducer to convert some aspect of the physical phenomena to an electrical signal, an amplifier, and other electronic circuitry to increase the amplitude of the random fluctuations to a measurable level, and some type of analog to digital converter to convert the output into a digital number, often a simple binary digit zero or one. By repeatedly sampling the randomly varying signal,

a series of random numbers is obtained. The main application for electronic hardware random number generators is in cryptography, where they are used to generate random cryptographic keys to transmit data securely. They are widely used in internet encryption protocols such as Transport Layer Security, TLS. Random number generators can also be built

from random macroscopic processes using devices such as coin flipping, dice, roulette wheels, and lottery machines. The presence of unpredictability in these phenomena can be justified by the theory of unstable, dynamical systems, and chaos theory. Even though macroscopic processes are deterministic under Newtonian mechanics, the output of a well-designed device like a roulette wheel cannot be predicted in practice,

because it depends on the sensitive micro-details of the initial conditions of each use. Although dice have been mostly used in gambling and as randomizing elements in games, The Victorian scientist Francis Galton described a way to use dice to explicitly generate random numbers for scientific purposes in 1890. Hardware random number generators generally produce only a limited number of random bits per second. In order to increase the available output data rate, they are often used to generate the seed for a faster cryptographically secure pseudo-random number generator. which then generates a pseudo-random output sequence at a much higher data rate. Uses Unpredictable random numbers were first investigated in the context of gambling,

and many randomizing devices such as dice, shuffling playing cards, and roulette wheels, were first developed for such use. Fairly produced random numbers are vital to electronic gambling, and ways of creating them are sometimes regulated by good. governmental gaming commissions. Random numbers are also used for non-gambling purposes, both where their use is mathematically important, such as sampling for opinion polls,

and in situations where fairness is approximated by randomization, such as military draft lotteries and selecting jurors. Cryptography The major use for hardware random number generators is in the field of data encryption. For example, to create random cryptographic keys and nonces needed to encrypt and sign data. They are a more secure alternative to pseudo-random number generations, PRNGs. Software programs commonly used in computers to generate random numbers. PRNGs use a deterministic algorithm to produce numerical sequences.

Although these pseudo-random sequences pass statistical, pattern tests for randomness, by knowing the algorithm and the conditions used to initialize it called the seed, the output can be predicted. Because the sequence of numbers produced by PRNG is in principle predictable, data encryption with pseudo-random numbers is potentially vulnerable to cryptanalysis. Hardware random number generators produce sequences of numbers that are assumed not to be predictable, and therefore provide the greatest security when used to encrypt data. Early work One early way of producing random numbers was by a variation of the same machines used to play Kino or select lottery numbers.

These involved mixed numbering ping pong balls with blown air, perhaps combined with mechanical agitation, and used some method to withdraw balls from the mixing chamber. This method gives reasonable results in some senses, but the random numbers generated by this means are expensive. The method is inherently slow and is unusable for most computing applications. On April 29, 1947, RAND Corporation began generating random digits with an electronic roulette wheel, consisting of a random frequency pulse source of about 100,000 pulses per second. gated once per second with a constant frequency pulse and fed into a 5-bit binary counter. Douglas Aircraft built the equipment implementing Cecil Hastings' suggestion for a noise source,

most likely the well-known behavior of the 64 miniature gas-thyrotron tube, when placed in a magnetic field. 20 of the 32 possible countervalues were mapped onto the 10 decimal digits, and the other 12 countervalues were discarded. The results of a long run from the RAND machine, filtered and tested, were converted into a table, which was published in 1955 in the book, a million random digits with 100,000 normal deviates. The RAND table was a significant breakthrough in delivering random numbers

because such a large and carefully prepared table had never before been available. It has been a useful source for simulations, modeling, and for deriving the arbitrary constants in cryptographic algorithms to demonstrate that the constants had not been selected maliciously. The block ciphers, Kufu, and Khafrey are among the applications which used the RAND table. Physical phenomena with random properties Quantum Random Properties There are two fundamental sources of practical quantum mechanical physical randomness, quantum mechanics at the atomic or subatomic level,

and thermal noise, some of which is quantum mechanical in origin. Quantum mechanics predicts that certain physical phenomena such as the nuclear decay of atoms are fundamentally random and cannot in principle be predicted. and because the world exists at a temperature above absolute zero, every system has some random variation in its state. For instance, molecules of gases composing air are constantly bouncing off each other in a random way. This randomness is a quantum phenomenon as well.

Because the outcome of quantum mechanical events cannot be predicted even in principle, they are the gold standard for random number generation. Some quantum phenomena used for random number generation include shot noise, a quantum mechanical noise source in electronic circuits. A simple example is a lamp shining on a photodiod. Due to the uncertainty principle, arriving photons create noise in the circuit. Collecting the noise for use poses some problems,

but this is an especially simple random noise source. However, shot noise energy is not always well distributed throughout the bandwidth of interest. Gas diode and thyrotron electron tubes in a crosswise magnetic field can generate substantial noise energy, but have a very peaked energy distribution and require careful filtering to achieve flatness across the broad spectrum. A nuclear decay radiation source detected by a Geiger counter attached to a PC. Photons traveling through a semi-transparent mirror, the mutually exclusive events, reflection, transmission, are detected and associated to zero or one-bit values respectively.

Amplification of the signal produced on the base of a reverse-biased transistor. The emitter is saturated with electrons, and occasionally they will tunnel through the bandcap and exit via the base. This signal is then amplified through a few more transistors and the result fed into a Schmidt trigger. Spontaneous parametric down conversion leading to binary phase state selection in a degenerate optical parametric oscillator. Fluctuations in vacuum energy measured through homodyne detection.

Classical random properties. Thermal phenomena are easier to detect. They are somewhat vulnerable to attack by lowering the temperature of the system, though most systems will stop operating at temperatures low enough to reduce noise by a factor of two. Some of the thermal phenomena used include thermal noise from a resistor, amplified to provide a random voltage source, avalanche noise generated from an avalanche diode or Zenner breakdown noise, from a reverse-biased zenor diode.

Atmospheric noise detected by a radio receiver attached to a PC, though much of it, such as lightning noise, is not properly thermal noise, but most likely a chaotic phenomenon. In the absence of quantum effects or thermal noise, other phenomena that tend to be random, although in ways not easily characterized by laws of physics, can be used.

When several such such things, sources are combined carefully, as in, for example, the Yarrow algorithm or Fortuna CSPRNGs, enough entropy can be collected for the creation of cryptographic keys and nonces, though generally at restricted rates. The advantage is that this approach needs, in principle, no special hardware. The disadvantage is that a sufficiently knowledgeable attacker can surreptitiously modify the software or its inputs, thus reducing the randomness of the output, perhaps substantially. The primary source of randomness typically used in such approaches is the precise timing of the interrupts caused by mechanical input output devices,

such as keyboards and disk drives, various system information counters, etc. The last approach must be implemented carefully and may be subject to attack if it is not. For instance, the forward security of the generator in Linux 2.6.10 kernel could be broken with 2 to the 64th or 2 to the 96 time complexity. Clock drift. Another variable physical phenomenon that is easy to measure is clock drift. There are several ways to measure and use clock drift as a source of randomness. The Intel 82802 firmware hub FWH chip included a hardware RNG using two free running oscillators, one fast and one slow. A thermal noise source, non-common mode noise from two diodes is used to modulate the frequency of the slower oscillator, which then triggers a measurement of the fast oscillator. That output is then debiased using a von Neumann-type decorrelation step.

The output rate of this device is somewhat less than 100,000 bits per second. This chip was an optional component of the 840 chip set family that supported an earlier Intel bus. It is not included in modern PCs. All VIA C3 microprocessors have included a hardware RNG on the process. or chip since 2003. Instead of using thermal noise, raw bits are generated by using four free-running oscillators, which are designed to run at different rates.

The output of two are ex-o-red to control the bias on a third oscillator, whose output clocks the output of the fourth oscillator to produce the raw bit. Minor variations in temperature, silicon characteristics and local electrical conditions cause continuing oscillator speed variations and thus produce the entropy of the raw bits. To further ensure randomness, there are actually two such RNGs on each chip, each positioned in different environments and rotated on the silicon. The final output is a mix of these two generators. The raw output rate is tens to hundreds of megabits per second, and the whitened rate is a few megabits per second.

User software can access the generated random bitstream using new non-privileged machine language instructions. A software implementation of a related idea on ordinary hardware is included in CryptoLib, a cryptographic routine library. The algorithm is called TrueRAND. Most modern computers have two crystal oscillators, one for the real-time clock and one for the primary CPU clock. True Rand exploits this fact. It uses an operating system service that sets an alarm running off the real-time clock. One subroutine sets the alarm to go off in one-clock tick, usually one-60th of a second.

Another then enters a while loop waiting for the alarm to trigger. Since the alarm will not always trigger in exactly one tick, The least significant bits of a count of loop iterations between setting the alarm and its trigger will vary randomly, possibly enough for some uses. True RAND doesn't require additional hardware, but in a multitasking system, great care must be taken to avoid non-randomizing interference from other processes, e.g. in the suspension of the counting loop process as the operating system scheduler starts and stops assorted processes. The RD-RAND op code will return values from an onboard hardware random number

generator. It is present in Intel Ivy Bridge processors and AMD 64 processors since 2015. Dealing with bias. The bitstream from such systems is prone to be biased with either ones or zeros predominating. There are two approaches to dealing with bias and other artifacts. The first is to design the RNG to minimize bias inherent in the operation of the generator. One method to correct this feeds back the generated bitstream, filtered by a low-pass filter to adjust the bias of the generator. By the central limit theorem, the feedback loop will tend to be well adjusted almost all the time. Ultra-high-speed random number generators often use this method. Even then, the numbers generated are usually somewhat biased. Software whitening. A second approach to coping with bias is to reduce it after generation

in software or hardware. There are several techniques for reducing bias and correlation, often called whitening algorithms, by analogy with the related problem of producing white noise from a correlated signal. John von Neumann invented a simple algorithm to fix simple bias and reduce correlation. It considers two bits at a time non-overlapping, taking one of three actions. When two successive bits are equal, they are discarded. A sequence of one, zero becomes a one, and a sequence of zero-one becomes a zero. It thus represents a falling edge with a one and a rising edge with a zero. This eliminates simple bias and is easy to implement as a computer program or in digital logic.

This technique works no matter how the bits have been generated. It cannot assure randomness in its output, however. What it can do with significant numbers of discarded bits is transform a biased random bitstream into an unbiased one. Another technique for improving a near-random bitstream is to exclusive or the bitstream, with the output of a high-quality cryptographically secure pseudo-random number generator, such as a Blum-Blum-Shub or a strong stream cipher.

This can improve decorrelation and digit bias at low cost. It can be done by hardware, such as an FPGA, which is faster than doing it by software. Some designs apply cryptographic hash functions, such as MD5, SH1, or Ripe. MD-160, or even a CRC function, to all or part of the bitstream, and then use the output as the random bitstream. This is attractive, partly because it is relatively fast. Many physical phenomena can be used to generate bits that are highly biased, but each bit is independent from the others. A Geiger

counter with a sample time longer than the tube recovery time, or a semi-transparent mirror photon detector, both generate bit streams that are mostly zero, silent or transmission, with the occasional one, click, or reflection. If each bit is independent from the others, the von Neumann strategy generates one-biased output bit for each of the rare one bits in such a highly biased bitstream. Whitening techniques such as the advanced multi-level strategy AMLS can extract more output bits, output bits that are just as random and unbiased from such a highly biased bitstream. PRNG with periodically refreshed random key. Other designs use what are believed to be true random bits as the key for a high-quality block cipher algorithm,

taking the encrypted output as the random bitstream. Care must be taken in these cases to select an appropriate block mode, however. In some implementations, the PRNG is run for a limited number of digits, while the hardware generating device produces a new seed, using observed events. Software engineers with out-true random number generators often try to develop them by measuring physical events available to the software. An example is measuring the time between user keystrokes,

and then taking the least significant bit or two or three, of the count as a random digit. A similar approach measures task scheduling, network hits, diskhead seek times, and other internal events. One Microsoft design includes a very long list of such internal values, a form of cryptographically secure pseudo-random number generator. Lava lamps have also been used as the physical devices to be monitored, as in the lava-rand system.

the method is risky when it uses computer-controlled events because a clever malicious attacker might be able to predict a cryptographic key by controlling the external events. It is also risky because the supposed user-generated event, e.g. keystrokes, can be spoofed by a sufficiently ingenious hacker, allowing control of the random values used by the cryptography. However, with sufficient care, a system can be designed that produces cryptographically secure random numbers from the sources of randomness available in a modern computer. The basic design is to maintain an entropy pool of random bits that are assumed to be unknown to an attacker. New randomness is added whenever available, for example when the user hits a key, and an estimate of the number of bits in the pool

that cannot be known to an attacker is kept. Some of the strategies in use include, when random bits are requested, return that many bits derived from the entropy pool by a cryptographic hash function, say, and decrement the estimate of the number of random bits remaining in the pool. If not enough unknown bits are available,

wait until enough are available. This is the top-level design of the dev-random device, in Linux, written by Theodore Tso and used in many other Unix-like operating systems. It provides high-quality random numbers so long as the estimate of the input randomness are sufficiently cautious. The Linux dev-view random device is a simple modification, which disregards estimates of input randomness, and is therefore rather less likely to have eye entropy as a result. Maintain a stream cipher with a key and initialization vector, IV, obtained from an entropy pool. When enough bits of entropy have been collected, replace both key and IV with new

random values and decrease the estimated entropy remaining in the pool. This is the approach taken by the Yarrow Library. It provides resistance against some attacks and conserves hard-to-obtain entropy. Decentralize. systems. A true random number generator can be a decentralized service. One example of a centralized system where a random number can be acquired is the randomness beacon service from the National Institute of Standards and Technology. Another example is random.org, a service that uses atmospheric noise to generate random binary digits, bits. As an example of a decentralized system,

the Cardinot Platform uses the participants of their decentralized proof-of-stake protocol to generate random numbers. Problems It is very easy to misconstrruct hardware or software devices which attempt to generate random numbers. Also, most break silently. often producing decreasingly random numbers as they degrade. A physical example might be the rapidly decreasing radioactivity

of the smoke detectors mentioned earlier if this source were used directly. Failure modes in such devices are plentiful and are complicated, slow, and hard to detect. Methods that combine multiple sources of entropy are more robust. Because many entropy sources are often quite fragile and fail silently, statistical tests on their output should be performed continuously. Many but not all such devices include some such tests into the software that reads the device.

Attacks Just as with other components of a cryptography system, a software random number generator should be designed to resist certain attacks. Defending against these attacks is difficult without a hardware entropy source. Estimating entropy There are mathematical techniques for estimating the entropy of a sequence of symbols. None are so reliable that their estimates can be fully relied upon. There are always assumptions which may be very difficult to confirm.

These are useful for determining if there is enough entropy in a seed pool, for example. but they cannot in general distinguish between a true random source and a pseudo-random generator. This problem is avoided by the conservative use of hardware enterprise sources. Performance test Hardware random number generators should be constantly monitored for proper operation. RFC 4086 FIPS Pub 140-2 and NIST Special Publication 800-90B include tests which can be used for this. Also see the documentation for the New Zealand Cryptographic Software Library Cryptlib.

Since many practical designs rely on a hardware source as an input, it will be useful to at least check that the source is still operating. Statistical tests can often detect failure of. a noise source, such as a radio station transmitting on a channel thought to be empty, for example. Noise generator output should be sampled for testing before being passed through a whitener. Some whitener designs can pass statistical tests with no random input. While detecting a large deviation from perfection would be a sign that a true random noise source has become degraded, small deviations are normal.

and can be an indication of proper operation. Correlation of bias in the inputs to a generator design with other parameters, e.g. internal temperature, bus voltage, might be additionally useful as a further check. Unfortunately, with currently available and foreseen tests, passing such tests is not enough to be sure the output sequences are random. A carefully chosen design verification that the manufactured device implements that design, and continuous physical security to ensure against tampering may all be needed in addition to testing for high-value uses.