I have hardware-based RNG which consists of TRNG and PRNG. TRNG is giving out a 512-bit number which is being used as a seed for PRNG. RNG is generating a 160-bit random number using PRNG and reseeding is done after $2^{20}$ numbers. I want to use hardware-based RNG as an entropy source. What should be used as a source of entropy i.e. output of TRNG or PRNG?
$\begingroup$
$\endgroup$
9
-
1$\begingroup$ As pure entropy source for a software (CS)PRNG? Always use the TRNG. $\endgroup$– SEJPMJul 29, 2016 at 22:13
-
1$\begingroup$ For information-theoretical reasons, the roughly $160$ million bits obtained from the PRNG before reseeding still have a total entropy of at most $512$ bits. On the other hand, the TRNG should in theory yield a full bit of entropy per extracted bit. $\endgroup$– yyyyyyyJul 29, 2016 at 23:17
-
$\begingroup$ SEjPM & yyyyyyy , Thanks for your replies. @yyyyyyy , simplified formula for entropy (log2n) gives value of 7.32 for 160 bits and 9 for 512 bits. Will I be justified to claim 7.32 bit entropy if I decide to use output of RNG ? $\endgroup$– user2363993Jul 30, 2016 at 0:05
-
1$\begingroup$ Why can't you just use the TRNG as the RNG without interposing a PRNG? The randomness is better that way... $\endgroup$– Paul UszakSep 11, 2016 at 21:55
-
1$\begingroup$ @ModalNest 512? Absolutely. It would just produce rubbish. ADC stuff is really electronics and not so much crypto, but have a look at the Wiki page and the effective number of bits specifically. And try to buy one from here. Those are world class ADCs used in aerospace/defence. 32 bits max and there are few shops in the world that can produce a design that effectively uses most of them. $\endgroup$– Paul UszakDec 23, 2020 at 14:37
|
Show 4 more comments
1 Answer
$\begingroup$
$\endgroup$
6
If you need an entropy source, that's the TRNG, kind of by definition. A TRNG provides unpredictable output by physical means. An entropy source is one that provides unpredictable output; the entropy is a measure of how unpredictable.
Hardware entropy sources are rarely uniform, so they should never be used as an RNG, but as a seed to a CSPRNG, i.e. a deterministic algorithm that “smoothen” all correlations between bits.
So if you really need an entropy source, use the TRNG. But if what you're doing is anything other than seeding a CSPRNG, then what you really need is a random source; for that, use the CSPRNG seeded by the TRNG.
Having a 160-bit output makes me fear that your CSPRNG is based on SHA-1. SHA-1 is deprecated, but not broken yet. If you're using SHA-1, you should plan to replace it by SHA-256, but it isn't very urgent. What matters is primarily that you use a good CSPRNG algorithm on top of whatever hash or other cryptographic primitive you're using, hopefully NIST's Hash_DRBG or HMAC_DRBG if it's based on a hash.
simplified formula for entropy (log2n) gives value of 7.32 for 160 bits and 9 for 512 bits. Will I be justified to claim 7.32 bit entropy if I decide to use the output of RNG?
Your calculation doesn't make sense. Think of what $n$ is in this formula! The entropy of a source with $n$ possible different equiprobable values is $\log_2(n)$. The entropy of a source that provides $k$ independent bits is $k$. If your source provided 512 independent bits then you would get 512 bits of entropy from it, but in practice physical sources have some amount of correlation that's hard to evaluate precisely, so you probably have much less. In any case, what matters with entropy is that it's sufficient to make the probability that a brute-force attack would succeed negligible. For this purpose, there is no meaningful difference between 160 bits and 512 bits.
Squeamish Ossifrage
47.9k3 gold badges115 silver badges221 bronze badges
answered Jul 30, 2016 at 2:11
Gilles 'SO- stop being evil'Gilles 'SO- stop being evil'
18.5k4 gold badges47 silver badges88 bronze badges
-
$\begingroup$ Just to clarify some confusions. Entropy source $\ne$ TRNG. And a TRNG doesn't require a CSPRNG which is actually kinda dangerous. Or any type of cryptographic processing whatsoever. The inherent security comes from non determinism. $\endgroup$ Nov 3, 2019 at 2:52
-
2$\begingroup$ @PaulUszak As you've been told many times on this site, you don't understand how to build a random generator. A random generator without a CSPRNG would be very dangerous. Please stop spamming uninformed comments. $\endgroup$ Nov 3, 2019 at 10:31
-
$\begingroup$ Okey-dokey, but I'm trying to help you with the 1st part of your answer which is pretty wrong. It's a common mistake to think that cryptography is necessary within a TRNG. Commercial and laboratory one's (or mine) don't do it that way. $\endgroup$ Nov 3, 2019 at 13:45
-
1$\begingroup$ @Trey No, when I say that entropy sources are not uniform, I mean that they are not uniform, which means that they are somewhat predictable. For example, a source might have a 55% chance that the first bit is 1, and a 90% chance that the second bit is identical to the first one. You can't be sure that the output will be 11, but it's a good bet. A CSPRNG is necessary to smoothen out these physical effects. $\endgroup$ Sep 25, 2020 at 7:49
-
1$\begingroup$ @Trey 'Uniform' relates to the probability mass function. It's the quantisezed values of the raw entropy source as sampled by an observer, e.g. voltage levels returned from say a 12 bit analogue to digital converter. Have a looksee at this Ozzie TRNG. Notice that no CSPRNG is wanted/needed as stated above. Focus on Figure 2 and the distribution of samples. Most sources are pointy. $\endgroup$ Dec 22, 2020 at 14:13