# Embedded device needs PRNG, has AES & EEPROM

TL;DR - the device is just a microcontroller and essentially does whole-disk encryption. At initialization time, I need a PRNG to create the key material.

I have a software AES ECB encrypt operation (among other things - I also have CTR mode, but it isn't tooled for this use, and I have AES CMAC).

Some quick googling suggests that if I had a 16 byte PRNG key, then I could simply keep a 16 byte counter value and count from 0 for each block, run that through ECB and use that as the PRNG output.

I don't mind performing a read of /dev/urandom at manufacturing time and writing that into the controller's EEPROM.

Is it really just that simple?

Is there any reasonable alternative to pre-seeding the PRNG key (I'm guessing not)?

• This question was asked and answered on security.stackexchange: Would it be secure to generate random number using AES? – Joost Apr 3 '17 at 7:57
• i would have a setup routine, somewhat like openssl, where the user must wait a while the first time, while entropy is gathered. – dandavis Apr 3 '17 at 18:02
• That begs the question... entropy gathered from where? – nsayer Apr 3 '17 at 22:52
• Does Orthrus not have a user supplied key then? It's entirely locked to the pair of storage media? – Paul Uszak Apr 4 '17 at 12:54
• Yes - that's the whole point. – nsayer Apr 4 '17 at 16:31

No it's not that simple because you'll be selling kit that has predetermined secret information within it. Why should I use Orthrus when you know the PRNG seed? How can I trust you when your user name starts with the letters NSA? Seriously though, I don't think that your Mega32 is a secure chip (cryptographically) so someone might be able to read back the seed using their own software. There might also be side channel attacks. (It might be worth while posting another question specifically regarding use of a Mega32 for secure computation. There are people here who are very knowledgeable about that).

That aside, you have huge computational power on that chip and a shed load of I/O ports including a comparator on port D. And you have AES functionality. Include a hardware random entropy source. They're fairly easy and there are circuits widely available. Try to avoid using a reverse biased transistor as they're unstable long term, but if you only switch them on at card initialisation, you'll be fine.

Build one or two transistor or diode circuits, feed them though your comparator and you'll get thousands of bits of entropy in a few seconds. Worth the wait for the undoubted benefits. Pass a secure hash function over it like SHA-1, and you have your perfect seed material. (I personally prefer Pearson hashes in memory rich environments). You can generate 16 bytes of pure entropy in no time. Ask another question about the specifics of this later.

The important part of what I've said is marketing. You can market a hardware entropy source on the grounds of "quantum security" , "no one knows the seed", "unique randomness" etc. Sounds a lot better than "I hid something inside the chip that I hope no one finds. Ever". The value of security through obscurity is debatable, but either way cannot trump quantum physics.

• 1. The proposal was a unique seed key per device, not a fixed one for all of them. 2. Yes, you can read the seed material easily if you chose. You could also alter that data at any time if you also chose. 3. I didn't think really trustworthy hardware RNG was reasonable, but I will revisit that. – nsayer Apr 3 '17 at 13:40
• @nsayer Oh I meant having an entropy circuit on every Orthrus. That's the comparator I was referring to. No big. – Paul Uszak Apr 3 '17 at 22:23
• I am going to see if an avalanche diode entropy source can be reasonably done, but assuming for the moment that it can't, is a unique random seed value per device that can be field-replaced a reasonable PRNG solution for creating key material? – nsayer Apr 3 '17 at 22:55
• ... quantum physics. - are (let's just call it) "irrelevant" at the time I'm writing this comment. This is indeed bound to change in the next decade, but we're definitely not there just yet. Besides, the question didn't mention (or hint at) the term "quantum", "quantum security", or "quantum resistance" in any way. If it did, your beloved Pearson hashes would be a rather (let's just call it) "weird" suggestion from a quantum cryptanalysis perspective. – e-sushi Apr 4 '17 at 6:12
• @e-sushi The quantum bit refers to quantum mechanical tunnelling through the pn junction of a Zener diode when it's reverse biased. That's what I'm suggesting is used to generate entropy. And it sounds really good from a marketing perspective. – Paul Uszak Apr 4 '17 at 12:51