4
$\begingroup$

Considering that algorithmic methods for generating unpredictable streams are hard to come by, I've wondered if any of these potential sources are good for making keys, seeds, and the like:

  • stocks, bonds, and other economic indicators.
  • weather patterns, temperatures, humidity, stream video of the sky, and other environmental variables.
  • photos taken by anyone at all.
  • noise in a room.
  • traffic patterns.
  • seismic activity.

Are any of these methods used?

$\endgroup$
  • 5
    $\begingroup$ 1) You need something secret to seed a CSPRNG. 2) How would you obtain that data? If you download it, and you even trust the source to keep the data secret, you still need enough random data beforehand to initiate a TLS connection. But if you already have a good random seed, why bother with that stuff? $\endgroup$ – CodesInChaos Feb 15 '15 at 21:31
  • $\begingroup$ here is a paper you may find interesting $\endgroup$ – mikeazo Feb 16 '15 at 15:21
2
$\begingroup$

Potentially almost any data input can be used as seed. But in general you don't want to use information that can be trusted to have high entropy and be secret all the time. This rules out stock exchange and the weather for instance, as the stock exchange may be down, and there is not much entropy in a clear blue skye.

Almost all of the sources you mention rely on outside phenomenons, which means you have to trust the source. Moreover, you'll need a trusted path to your source, and the trusted path likely requires a random number generator. So you would get into a chicken/egg situation.

What is usually done is to rely on a local phenomenon and then use highly unpredictive measurements. Local phenomenons can be kept secret and measuring in the extreme will mean that you aren't dependent on large fluctuations. For instance a HDD can be used to inform the system about I/O times, and measuring in nano-seconds will give enough entropy for a few bits of seed.

Of course, you neverk know what kind of system you are going to find. So fortunately it starts to be commonplace to include a random number generator in CPU's. An RNG in the CPU or - for instance - in a TPM is probably the best RNG you can find.

| improve this answer | |
$\endgroup$
  • 1
    $\begingroup$ Why is our network down? Well, no earthquakes, but maybe if you shout instead of whisper... $\endgroup$ – Maarten Bodewes Feb 16 '15 at 3:58
  • $\begingroup$ Agreed with this post, do not rely on outside phenomena. www.random.org can provide you randomness (very good for gaming), and still untrusted. Use something local : local internal clock, processor thermal measurement, time between boot and the first multicast packet received. Don't expect it to be strong randomness at all, and don't expect a portable solution across platforms, processors, network environment ..... Some processor provide a random generator you can use to build your seeds (and only the seeds). Keys and Numbers MUST be built from a seeded standard PRNG. $\endgroup$ – Pierre Feb 16 '15 at 5:46
-8
$\begingroup$

I personally found there is the only true randomness generated by computers. It' simply data corruption.

Everyone hates data corruption because it means nothing to them, and true randomness means nothing as well. I experienced corrupted photo files whose broken pixels obscured the original image randomly.

I recommend making data corruption by executing several threads without lock. It will be absolutely unpredictable and there is no definite pattern. I personally did it in python

To make my idea clear, here is a thread about how threads without lock can easily make data corruption

https://msdn.microsoft.com/en-us/magazine/cc163744.aspx

In this post, it is clear that many threads share the same resource, and computers can easily make mistakes. This is why developers use locks.

and I highly recommend trying to predict the outcome of this script. It is dependent on OS, so just suppose the default is Windows (because it is so widely used)

https://github.com/Hojung-Jeong/Silver-Bullet-Random-Number-Generator/blob/master/propellant.py

| improve this answer | |
$\endgroup$
  • 1
    $\begingroup$ Several thread without lock is not unpredictable : the thread scheduler, from a crypto point of view, is highly predictable. Then you can't call it data corruption : the programs(s) running on different threads would be deterministic, and the hardware is deterministic too, nothing is "corrupted". What you call "unpredictable" is just "can't be analysed by a human brain". Only external events (like interactions from network) would make things behaving slightly differently from a computer to the next one. Have a look on the other post regarding the feeling about external events. $\endgroup$ – Pierre Feb 16 '15 at 7:32
  • $\begingroup$ You would have to make sure that an attacker cannot influence the scheduler as well. You might end up with precious little data corruption otherwise. $\endgroup$ – Maarten Bodewes Feb 16 '15 at 7:42
  • $\begingroup$ I posted another answer explaining my idea $\endgroup$ – OK Lets begin Feb 16 '15 at 10:05
  • $\begingroup$ @OKLetsbegin, Don't post another answer. Clarify your thoughts in the existing answer. (use the 'edit' link) P.S. I edited them in for you this time. $\endgroup$ – mikeazo Feb 16 '15 at 15:22
  • $\begingroup$ Sorry on posting another answer rather than editing the existing one. $\endgroup$ – OK Lets begin Feb 16 '15 at 15:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.