Are mouse movement coordinates useful as a seed for a RNG?

Question

Is it good to use a mouse movement as a 64-bit random seed for a Pseudorandom Generator like AES in Counter Mode?

Should I only need to get the X and Y coordinates of the mouse movement?

Answer 1

I suppose as far as entropy sources go, you could have chosen much, much worse. In fact a user properly moving his mouse while you collect a bunch of samples and hash them all together to obtain a seed is a pretty good random bit generator. Be conservative in your entropy estimates, for instance I would estimate no more than two bits of entropy per sample if you collect them intelligently (e.g. avoid continuous duplicates and keep a reasonably large sampling rate).

However obviously, a single mouse position is a terrible seed to use, since it doesn't even cover the whole 64-bit space. Your monitor is probably at best 1920x1080, which corresponds to about 2 million possible positions. WEAK.

But while this may be useful to keep in mind, it's probably best if you use an existing CSPRNG for your randomness needs, that way you don't bother the user, and you delegate security to someone else (which may be a good or a bad thing). You should always use the CSPRNG provided by your operating system as it is best placed to collect entropy, whether you like it or not. Under Windows, you can use CryptGenRandom() to access it.

It might seem counterproductive to use another RNG to seed your own, but entropy collection isn't exactly a trivial little thing that you just plug into a program. It has to be carefully and constantly monitored and tracked to keep a good estimate of the available entropy and ensure you don't lose any of it. Sure, making your own ultrafast PRNG using AES in counter mode for your specific needs might be worth it, but you need to consider the limits of your own random generator.

Answer 2

There are a few questions here.

• Are mouse movements a good entropy source? In general no, but there are a number of programs that will ask the user to move the mouse randomly, sample the position at intervals, and use many samples as a source of entropy for random number generation.

• Can you use mouse movement as the nonce in CTR mode? You shouldn't use a single mouse position as the nonce as there is not enough entropy. You could potentially use a process similar to what I describe in the first part of my answer to build up enough entropy to generate a good nonce, but since most all modern operating systems have a good random number generator built in, why not use that?

• Is 64 bits enough? This totally depends on other factors of the system. For example, how often do you re-key. Repeating the same nonce with the same key will have devastating results. So, if you re-key every session, 64 bits is plenty. IPSEC ESP uses a 32 bit nonce for AES-CTR. Some of this also depends on how you combine the nonce with the counter. A large nonce concatenated with a small counter has it's benefits and disadvantages. You could use XOR or addition as other methods of combining the two.

• Do you only need X and Y coordinates? I am not exactly sure what you are proposing here. If you are asking if X,Y coordinates are sufficient for securely generating a nonce, the answer is that it depends on how you do it exactly. Ideally, you should take many samples after requesting that the user move the mouse randomly. Modern PRNGs, however, use many entropy sources for security reasons. You'd be better off using modern PRNGs and specifically, not trying to reinvent the wheel when tried and tested solutions already exist.