4
$\begingroup$

I'm working on a true random number generator, and I came across this phrase in the American NIST guide, in section 6.4.1 Non-Approved Conditioning Components:

The entropy rate provided shall be no greater than the entropy rate provided by the input to the conditioning component; full entropy shall not be provided by non-approved conditioning components.

This suggests that you can have a random number generator that does not provide full entropy. So if you use the de-rigour noisy diode source natively generating approximately 50% pure entropy, your generator can only output 50% entropy. I'm unaware of any source that can natively generate 8 bits /byte entropy. It would actually be undesirable to run the source sampling equipment cranked up to 100% for many engineering reasons.

What is the point of a true random number generator that only produces half pure entropy? Do you only use it half of the time? Or do you just use every other byte (the random ones), ignoring the predictable ones? Seriously though, is it just a thinly veiled warning that "it's our way or no way"? Or..?

Improve this question
$\endgroup$
4
  • $\begingroup$ You need to condition and compress the entropy, see the whitepaper of Intel RDRAND on how they do it $\endgroup$
    – Richie Frame
    Jan 8, 2016 at 2:12
  • $\begingroup$ also that document is for the entropy source of a random number generator, you should not use an entropy source directly for random bits $\endgroup$
    – Richie Frame
    Jan 8, 2016 at 2:23
  • $\begingroup$ How do you get that a noisy diode source is natively generating approximately 50% pure entropy? For a start, it does not output bits; the conditioning circuit does, and it is very hard to tell the entropy rate of that output. $\endgroup$
    – fgrieu ♦
    Jan 8, 2016 at 7:46
  • $\begingroup$ @fgrieu Well actually... An analogue to digital conversion occurs in the sampling circuity. For reasons of gain linearity, slew rate limitations, and to get that 9 sigma spike you might well run amplification stages for 50% of max. rms output. You'll need a certain bias level just to turn the thing on. Hence (very roughly) 50% entropy going into the conditioning stage and my question. Entropy rate output is easily estimated via compression. Experimentation suggests 25% out from what goes into mine. $\endgroup$
    – Paul Uszak
    Jan 8, 2016 at 14:23

1 Answer 1

Reset to default
5
$\begingroup$

The NIST source you link to is SP 800-90B. If you look at the other two publications in the series: 90A and 90C, you can find explanations of how you can use a TRNG to instantiate a DRBG or requirements on how to condition the entropy.

Here is what section 7.1 of 90A says about entropy input to a DRBG:

Ideally, the entropy input will have full entropy; however, the DRBG mechanisms have been specified to allow for some bias in the entropy input by allowing the length of the entropy input to be longer than the required amount of entropy (expressed in bits). The entropy input can be defined to be a variable length (within limits), as well as fixed length.

So you can use a TRNG with 50% entropy rate to initialize a DRBG, you just need a longer input.

90C defines the assumptions more exactly in section 4.2:

  1. An entropy source output string containing $2n$ bits of entropy can be conditioned into a string of $n$ bits that contains full entropy output1 using an approved conditioning function, where $n$ is the length of the output block of the approved derivation function (see SP 800-90B). Note that in SP 800-90C, a derivation function2 is used as a conditioning function.
  2. A DRBG that has been instantiated at a given security_strength can be used to produce security_strength/2 bits of full entropy output if constructed as specified herein.

The approved conditioning functions are listed in 90B, after the section you quote. Anything else would fall under non-approved, but something sufficiently standard would be fine if you do not mind diverging from what NIST says.

So a half-entropy TRNG is very useful. You just need to take the entropy rate into account when using it.

Improve this answer
$\endgroup$
7
  • $\begingroup$ 1.) I think that one of us is confused, and I fear that it might be me. I understood that a TRNG produced true random numbers ready for use. That's what hardware manufacturers sell. That's what Wikipedia says. That's what HotBits do. Otherwise it's just an entropy source of indeterminate purity like smashing the keyboard. 2.) I'm looking to use the output from my generator directly, not as a seed for a DRBG. 3.) I specifically excluded section 4.2 from my question as I will be using an "unapproved" technique covered by section 6.4.1. Is this NSA leverage? $\endgroup$
    – Paul Uszak
    Jan 8, 2016 at 13:49
  • 3
    $\begingroup$ @Paul Uszak: I have met many sources with allegedly 1-bit entropy rate, and found all to be either distinguishable from random with a lot of high-resolution samples and a careful test; documented as conditioned; or poorly documented. I conclude there are 3 kinds of TRNG sources: (1) unconditioned with less that 1-bit entropy rate; (2) conditioned with 1-bit entropy rate; (3) snake oil. $\endgroup$
    – fgrieu ♦
    Jan 8, 2016 at 14:19
  • 1
    $\begingroup$ Guys. I think that we're talking semantics. By TRNG I mean the whole shebang. The entropy source, sampling circuitry, software conditioning and randomness extraction. $\endgroup$
    – Paul Uszak
    Jan 9, 2016 at 1:13
  • 2
    $\begingroup$ @PaulUszak in that case, you need to be aware that the document you referenced is ONLY talking about the entropy source, and its conditioning, not about randomness extraction. The notes about conditioned entropy are required for how to deal with extraction in the next stage, the DRBG, which has to make an assumption about the maximum entropy per bit of the source in order to produce quality output $\endgroup$
    – Richie Frame
    Jan 9, 2016 at 2:27
  • 2
    $\begingroup$ @PaulUszak, so what is your question at this point? Because the answer to those in the last paragraph of the actual question post is, as I wrote above, that it can be used as a DRBG seed or be conditioned for immediate use. $\endgroup$
    – otus
    Jan 9, 2016 at 8:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.