Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
How fast are the fastest ones? Which ones have the most entropy? Which ones are the most practical ones?
I tried looking for answers on Wikipedia and also, I tried reading papers, but I am couldn’t find answers to these questions. I was looking for a recent paper that would have compared all the TRNGs, but I couldn’t find one.
There is also an underlying assumption in the question: Is there a way we can rank order random number generators?
How fast are the fastest ones?
Chaotic laser emission is pretty much fastest. That's shoving a laser beam up itself. This one allegedly can be run at 1.2 Tbit/s:-
That's a start for your further research.
Which ones have the most entropy?
If it's a proper TRNG, they'll all have a min entropy approaching 1 bit/bit and an autocorrelation approaching 0.
Which ones are the most practical ones?
Old Linux's /dev/random was very useful as it could generate 1000's bits/minute when you were typing or mousing the PC. Unfortunately that was sabotaged out of existence in recent kernel changes. Cui bono? You can create a hardwareless TRNG by leveraging the non deterministic behaviour of modern CPUs, but the entropy rate is unpredictable. Doable nevertheless.
So I would say this is (technically an entropy source):-
If you need a TRNG, then the impossibility of personal audit and computational indistinguishability mean that the only secure TRNG is one that you build yourself. Like above which runs on a 9V battery.
“Relying solely on the hardware random number generator which is using an implementation sealed inside a chip which is impossible to audit is a BAD idea.” - Theodore Ts’o (/dev/random Linux node creator).
Random numbers allow one to have a private conversation, but that comes at a price (about £1 of components, some nails and an Arduino). There's a fun implementation and yet serious analysis here.
Lastly, we could order them by weight or colour but I'm not sure of the benefits of that. But if you were to order them by security, then the one above wins hands down as you know exactly what it's doing.
/dev/random(sic) change, that was a good thing. I supported it and even helped (to a limited extent) to get it through.” NSA mana, sabotage, or contractor objective? Cui bono? You’ve taken away the ability of the People to have easy privacy. Love to engage with you a bit more but at the moment the river’s flooding and we have to move the pigs.
$\endgroup$
Aug 5 at 22:26
How fast are the fastest TRNGs? Which ones have the most entropy?
This recent article claims 100 Gbit/s min-entropy, and gives reference to several >10 Gbit/s generators. These are lab experiments, where some quantum phenomenon is converted to digital with an Analog-to-Digital Converter. Much of the generator's entropy comes from the low-order bits of the ADC (it's acknowledged that an ADC with more bits increases the rate), thus I'm not so sure that most of the claimed entropy rate comes from the quantum phenomenon observed, rather than from (quantum) noise in the ADC.
It's dubious that such ultra-high speed is much useful in practical use cases, because a TRNG can be used to seed a Cryptographically Strong Pseudo-RNG, which can have high rate and (by definition) are indistinguishable from a TRNG. Even a 100 kbit/s rate (which would be easy with the practical constructs below) is fine to seed a CSPRNG with 256-bit state in under 3 ms, and very few applications need random numbers this soon after power-up.
Which ones are the most practical ones?
Common TRNGs in integrated circuits use ring oscillators, and/or noise generators compared to their mean, or combinations thereof. Their output is typically feeding a de-biasing circuit or/and a Pseudo-RNG.
The most practically important criteria for a TRNG in a crypto context is that it does not go, undetected, into a state such that it produces much less entropy than expected, by accident or because an adversary deliberately induced that (e.g. by spraying some liquefied gas on the gismo, connecting it to a power source with high ripple, putting it in latch-up with an ESD, or beaming some laser or powerful RF signal at it).
Typically, the hardest-to-get-right part is surveillance of the TRNG to detect that it fails, with two pitfalls to avoid: not detecting a failure, and false detection.
Is there a way we can rank random number generators ?
For cryptographic applications, the qualitative properties of TRNGs are ranked into functionality classes. The lowest, deprecated, basically is to pass statistical tests like NIST 800-22. Speed can also be a ranking criteria.
