16
$\begingroup$

The latest AMD programmer manuals, dated June 2015, include the RDRAND instruction in the instruction set. For completeness, it lacks RDSEED. Confer, AMD64 Architecture Programmer’s Manual Volume 3: General-Purpose and System Instructions, page 278.

The description includes the text:

Loads the destination register with a hardware-generated random value.

I'm having trouble finding information on AMD's circuit and other design/implementation details. I'm not getting specific hits when searching AMD's site, and a general web search is returning a lot of noise dominated by Intel (not Intel's fault, its just the way it is).

What is known about AMD's circuit?

Based on @Richie comments (it was a good lead): according to NIST's Validated FIPS 140-1 and FIPS 140-2 Cryptographic Modules, AMD does not have an approved module. Additionally, according to NIST's Modules In Process, AMD does not have something in evaluation.

| improve this question | |
$\endgroup$
  • 2
    $\begingroup$ I would assume it works the same way as Intel's, using the same NIST approved conditioner and DRBG $\endgroup$ – Richie Frame Oct 17 '15 at 0:07
  • 1
    $\begingroup$ I can't find Intel's on those lists either, so should you expect to find AMD's? $\endgroup$ – otus Oct 18 '15 at 18:15
  • 1
    $\begingroup$ Intel's HRNG is described in these slides (PDF). You may also be interested in AMD clRNG, which is AMD's OpenCL-based PRNG. $\endgroup$ – Polynomial Oct 21 '15 at 9:23
  • 2
    $\begingroup$ Note that there is a difference between using NIST approved algorithms such as a counter based DRBG and a having a NIST approved cryptographic module. I'm not even sure that the processor is enough of a cryptographic system by itself to be approved as such. $\endgroup$ – Maarten Bodewes♦ Jun 17 '16 at 23:35
3
$\begingroup$

These circuits use an asynchronous counter that is ringing, and are sometimes combined with a seed from the unique processor ID (you blow these with e-fuses during test)

If you take 32 ring oscillators in parallel that each supply a single bit, you will see a random 32-bit value every time you sample. The randomness introduced is due the Poisson process of charge arriving at different times across the channel of the device, and this is why ring oscillators are "noisy". This is why do not need a seed, you just need a few moments that taken when the CPU resets to achieve electrical chaos. I would probably even keep a few ground ties weak to substrate through the resistors to increase the charge distribution.

I also have seen an implementation of this were the a few inputs were then put into SHA-1 that was XOR'd with the processor ID, but just from the standpoint of physics, you could have just have the ring oscillators. I assume this approach was used because it's outlined in a NIST spec.

addendum:

The most approachable discussion of this noise is probably this paper:

R. Sarpeshkar, T. Delbruck, and C. A. Mead, “White noise in MOS transistors and resistors,” IEEE Circuits and Devices Magazine, vol. 9, no. 6, pp. 23–29, 1993.

| improve this answer | |
$\endgroup$
  • $\begingroup$ Please forgive my ignorance. Can you provide a link to the design in AMD's circuit? $\endgroup$ – user10496 Feb 9 '17 at 17:56
  • 5
    $\begingroup$ Do you have any sources for AMD using that design? $\endgroup$ – CodesInChaos Feb 9 '17 at 18:01
  • 2
    $\begingroup$ I saw a talk on this at ISSCC (isscc.org) that I'm trying to find, but this patent: google.com/patents/US6480072 is similar, but not the same. I'll pull my notes and comment if I find it. Also, it's important to note that the reason for the rings over the single resistor noise source is that you still show more entropy with the ring oscillators when you cool it. I can stop most hardware random number generators by super cooling them. $\endgroup$ – b degnan Feb 9 '17 at 20:26
  • $\begingroup$ I'm not super familiar with the term; if one replaces "the Poisson process" with "the random process", does the sentence still mean exactly the same thing? As far as I understand, Poisson only refers to a specific shape of the distribution $\endgroup$ – Luc Feb 15 '19 at 17:07
  • 1
    $\begingroup$ @Luc There's some nuance to the term as a physicist, where you expect that you are talking about something that is involving the meantime between collisions. This is why semiconductor noise is two-way shot noise, and not thermal (Johnson) noise. It's the behavior of a physical process, not just a mathematical fit, such as a Gaussian. $\endgroup$ – b degnan Feb 15 '19 at 20:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy