5
$\begingroup$

I have hardware based RNG which consists of TRNG and PRNG. TRNG is giving out 512 bit number which is being used as seed for PRNG. RNG is generating 160 bit random number using PRNG and reseeding is done after 2^20 numbers. I want to use hardware based RNG as entropy source. What should be used as source of entropy i.e. output of TRNG or PRNG ?

Any help/reply is appreciated please.

Thanks & Regards,

$\endgroup$
  • 1
    $\begingroup$ As pure entropy source for a software (CS)PRNG? Always use the TRNG. $\endgroup$ – SEJPM Jul 29 '16 at 22:13
  • 1
    $\begingroup$ For information-theoretical reasons, the roughly $160$ million bits obtained from the PRNG before reseeding still have a total entropy of at most $512$ bits. On the other hand, the TRNG should in theory yield a full bit of entropy per extracted bit. $\endgroup$ – yyyyyyy Jul 29 '16 at 23:17
  • $\begingroup$ SEjPM & yyyyyyy , Thanks for your replies. @yyyyyyy , simplified formula for entropy (log2n) gives value of 7.32 for 160 bits and 9 for 512 bits. Will I be justified to claim 7.32 bit entropy if I decide to use output of RNG ? $\endgroup$ – user2363993 Jul 30 '16 at 0:05
  • 1
    $\begingroup$ Why can't you just use the TRNG as the RNG without interposing a PRNG? The randomness is better that way... $\endgroup$ – Paul Uszak Sep 11 '16 at 21:55
5
$\begingroup$

If you need an entropy source, that's the TRNG, kind of by definition. A TRNG provides unpredictable output by physical means. An entropy source is one that provides unpredictable output; the entropy is a measure of how unpredictable.

Hardware entropy sources are rarely uniform, so they should never be used as an RNG, but as a seed to a CSPRNG, i.e. a deterministic algorithm that “smoothen” all correlations between bits.

So if you really need an entropy source, use the TRNG. But if what you're doing is anything other than seending a CSPRNG, then what you really need is a random source; for that, use the CSPRNG seeded by the TRNG.

Having a 160-bit output makes me fear that your CSPRNG is based on SHA-1. SHA-1 is deprecated, but not broken yet. If you're using SHA-1, you should plan to replace it by SHA-256, but it isn't very urgent. What matters is primarily that you use a good CSPRNG algorithm on top of whatever hash or other cryptographic primitive you're using, hopefully NIST's Hash_DRBG or HMAC_DRBG if it's based on a hash.

simplified formula for entropy (log2n) gives value of 7.32 for 160 bits and 9 for 512 bits. Will I be justified to claim 7.32 bit entropy if I decide to use output of RNG ?

Your calculation doesn't make sense. Think of what $n$ is in this formula! The entropy of a source with $n$ possible different equiprobable values is $\log_2(n)$. The entropy of a source that provides $k$ independent bits is $k$. If your source provided 512 independent bits then you would get 512 bits of entropy from it, but in practice physical sources have some amount of correlation that's hard to evaluate precisely, so you probably have much less. In any case, what matters with entropy is that it's sufficient to make the probability that a brute-force attack would succeed negligible. For this purpose, there is no meaningful difference between 160 bits and 512 bits.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.