Is there a secure source of entropy on a typical microcontroller?

On a device that does not have a hardware RNG, what is the best source for entropy?

Some options and pitfalls floating around:

• Use the ADC to read something analog: can become deterministic if there is access to power supply or some ADCs are just too stable even at LSB.
• Use un-init SRAM: power supply brownout attack?
• Use crystal jitter: idea here is to sample the variance between the RTC and MCU crystals and use LSB.
• Not an answer, bu the best solution in this environment it to get a random bitstring from "somewhere else" (such as wherever the public/private key pairs come from if the device has those) and use that as a seed for an RNG. Now you still don't have any (well, much) entropy but something that is at least secure from a number-theoretic point of view. – Thomas M. DuBuisson Aug 3 '15 at 16:34
• That would presumably be secure from a computational point of view, rather $\hspace{1.71 in}$ than just a number-theoretic point of view. $\;$ – user991 Aug 3 '15 at 17:08

Most microcontrollers that are suitable for crypto I've seen have a variant with a hardware RNG. For example the PIC32 series by Microchip.

However, if not, what you could do is attaching some sensor to an ADC. It would depend on your environment what kind of sensor you could use. It can be anything, which is not easily manipulated (at least not in the LSB(s)).

Then, take the LSB(s) from the ADC, or better yet, use a randomness extractor. How often you can fetch me bits, and how many you can fetch at a time, depends on the ADC, the sensor and the environment, and the security level you want to reach.

If you can go a bit further than just your microcontroller, there are some small hardware circuits that can be used to create randomness. One example is using a diode's avalanche effect.

Avalanche noise is the noise produced when a junction diode is operated at the onset of avalanche breakdown. It occurs when carriers acquire enough kinetic energy under the influence of the strong electric field to create additional electron-hole pairs by colliding with the atoms in the crystal lattice. If this process happens to spill over into an avalanche effect, random noise spikes may be observed.

In short, we can use a diode with some external circuitry to create random noise spikes. If we then amplify that signal and feed it to a comparator, we get a random bit string.

• If he can use a strong extractor, then he probably shouldn't just take the LSB(s). $\hspace{1.68 in}$ – user991 Aug 3 '15 at 21:39
• @RickyDemer could you expand on what constitutes a strong extractor on an mcu? – MandoMando Aug 5 '15 at 22:28
• "what constitutes a strong extractor on an mcu" is the same as $\hspace{2.46 in}$ "what constitutes a strong extractor on" anything. $\;$ – user991 Aug 6 '15 at 0:21
• In practice you should almost never use a strong extractor; simply hashing using a cryptographic hash function will almost always make more sense. (Assuming you are a practitioner/engineering building a product, rather than a theoretician interested in what theorems we can prove.) – D.W. Sep 3 '15 at 22:39

I have done some experiments here: https://github.com/kuro68k/xrng

TL;DR using the LSB of an Atmel XMEGA's internal temperature sensor and VCC/10 inputs to the ADC, then feeding that through a CRC32 algorithm for whitening resulted in an RNG that passed Diehard, NIST's tests and looks good in ent.

• What sort of generation rate do you get? – Paul Uszak Aug 22 '17 at 20:58
• How many entropy bytes do you hash in one go? I.E what is the compression level of the raw entropy? – Paul Uszak Aug 22 '17 at 21:00
• The code that passes Dieharder/NIST produces random bits at about 1Mb/sec. I have a 1:1 hash ratio. github.com/kuro68k/xrng/blob/master/finalAnalysisReport.txt I'm experimenting with 2:1 and 3:1 but with more sources of entropy to see if I can speed it up. – user25222 Aug 23 '17 at 7:35