3
$\begingroup$

My project is to build a true random number generator that relies on the avalanche effect in a Zener diode. This for a messaging device that uses one-time-pad encryption. Reading about similar projects, I assume to get fairly high entropy right from the raw stream. Next stage is to condition the bit stream in software to extract as much entropy as possible from it. I assume I will have both overall bias and serial correlations. In the end I want a bit stream with highest possible entropy, even if that means a much lower bit rate than the raw stream. I can afford relatively complex operations in my MCU. Cryptography is relatively new to me, so please bear with me and my beginner questions.

Would applying a cryptographic hash function like SHA-512 be enough? Is there a better algorithm for my needs?

The idea is to split the raw stream into blocks of 1024 bits, then run the SHA-512 for n number of blocks, and then output the resulting hash as the conditioned stream, and repeat. The question then becomes how many iterations I need to perform to get an acceptable level of entropy. How much more entropy can I expect to get from each hashing iteration? Since 100% entropy doesn't exist, I assume this process will slowly converge towards it, yielding less for each iteration.

$\endgroup$
4
  • $\begingroup$ Do you have an attack model? For instance, if I take your Ziener diode and physically short across it, you not longer have any entropy as it's stuck at a condition. $\endgroup$
    – b degnan
    Nov 27, 2023 at 10:01
  • 1
    $\begingroup$ Tampering with the device is not something I need to protect against. But of course it could short accidentally. And a slowly degrading diode would also be a problem. So I need a way to monitor the health of the raw bit stream. Tricky problem, because I can't see how I could implement a full entropy audit system into my microcontroller software. They are very complex. I could use a data compression test to catch the most obvious failures. I could write code to catch various common biases. But anything beyond that I have no idea how to test for. I'd be happy to get suggestions. $\endgroup$ Nov 27, 2023 at 10:40
  • $\begingroup$ In a messaging device, OTP encryption seldom helps. Compared to regular (authenticated) encryption, for message of $n$ bytes with $n$ over a hundred, it nearly doubles the total mount of data to transfer: from say $3k+n$ to $2n$ bytes where $k$ is the regular cipher's key length, often like 16 bytes. And the OTP vastly increases the amount of data to transfer with confidentiality using e.g. a trusted courier, from $k$ to $n$ bytes. And the OTP does not insure integrity. A benefit of OTP is that the courier can do their job before the encryption occurs, but is that a functional objective? $\endgroup$
    – fgrieu
    Nov 27, 2023 at 12:12
  • 2
    $\begingroup$ @fgrieu This will not be an issue for my project. The sender and receiver devices will have been primed with large amounts of random keys (from the TRNG) before the messaging begins. $\endgroup$ Nov 27, 2023 at 12:17

1 Answer 1

3
$\begingroup$

An excellent idea.

The complete design of a Zener TRNG is quite lengthy, so I'll just list a set of points and include a link to the details. You could do worse than starting with the following which can achieve a min. entropy of 7.9 bits/byte @ 8.8 kbits/s .

trng

  • A Zener TRNG only requires four principle components, including the diode. Go for 8.2V.

  • You cannot assume high entropy from the raw stream. As a beginner, assume 1-2 bit(s)/sample.

  • Bias is irrelevant at the sampling stage. Correlation is eliminated by reducing the sample rate and testing for IID.

  • SHA-256 is perfect and 768 input bits of entropy will produce 256 output bits of pure entropy with a world leading bias of $2^{-128}$. No repeating is necessary.

  • Final randomness testing can be undertaken with ent3000 for sub megabyte sample sizes and NIST's STS for larger ones.

  • As a response to comments you've received: OTP helps in that it is provably unbreakable, whereas primitives such as AES may already have been, or may be in the near future (hence the NSA data slurp & store).

There are full technical details, entropy measurement & analysis and randomness extraction here. It's too much to repeat.

$\endgroup$
10
  • $\begingroup$ Brilliant! Thank you very much. I had a quick look at your website, and you've really done a deep dive into the subject, will be interesting to study those pages in detail. A few quick questions, if you don't mind: $\endgroup$ Nov 27, 2023 at 16:06
  • $\begingroup$ On your website your tests were done at 10 kSa/s. Is that an Arduino limitation or do you keep it this low to not get serial correlation? When I look at your oscilloscope images, it looks like the avalanche effect cycle is typically less than 1 µs, which makes me think that it could be sampled at perhaps 250 kSa/s. $\endgroup$ Nov 27, 2023 at 16:07
  • 1
    $\begingroup$ Taking nothing away from the answer, but please note that the stance of Paul towards NIST is not the same stance that most cryptographers have. To me the problem with a TRNG is more about proving that it generates well distributed random bits. A single hash may also not necessarily create the best distribution, but that's probably a minimal problem and definitely better than using the TRNG directly. Pre destribution is of course fine as well, but note that you probably cannot store it in a secure area and that you need to carefully keep state or you get out of sync. $\endgroup$
    – Maarten Bodewes
    Nov 29, 2023 at 20:02
  • 1
    $\begingroup$ @fgrieu Some clarifications :-) The compression test statistic is obtained from the raw entropy stream. You compare the compressed size with an empirical CDF and a p value pops out. Fail the TRNG at what ever $\alpha$ floats your boat. It’s excellent at catching any, even subtle changes to the raw entropy rate, never mind a complete circuit break. Or a power failure, where H = 0. And this is what ent3000 does. $\endgroup$
    – Paul Uszak
    Dec 1, 2023 at 19:32
  • 1
    $\begingroup$ Remember that the above TRNG is not a mass use smart card. I’d spot a bunch of bad guys ”saturating the input with electromagnetic induction” whilst stood next to me. Or immersing it in liquid nitrogen... $\endgroup$
    – Paul Uszak
    Dec 1, 2023 at 19:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.