1
$\begingroup$

I came across the ChaosKey and I remember the time I came accros the entrypy key that was always out of stock. I would really want one to play with, I would like the best open source I can get for under 80 USD.

According to Wikipedia, ChaosKey is FIPS-140-2 and FST-01 (NeuG) is NIST SP800-22 certified.

Now, I must say I don't care about US standard as I'm sure they lower them to make sure everything is NSA friendly. I would rather trust EU standard or something but it's not the norm apparently.

ChaosKey have an output of 10Mbit/s while NeuG (promoted by the Free Software Foundation) have an output of 602 kbit/s.

Now one could say better output mean weaker random numbers, or one is older than the other. So I'm a little bit lost here.

There is also the OneRNG, which output at 350 kbit/s and the BitBabbler White at 2.5Mbit/s.

I'm lost guys, help please.

Sorry if this isn't the right SE to post this, a the time it looked right.

|improve this question
$\endgroup$
  • $\begingroup$ Comments are not for extended discussion; this conversation has been moved to chat. $\endgroup$ – e-sushi Sep 18 '17 at 8:04
  • $\begingroup$ The string "Chaos" is not in the list of FIPS-140-2 certified devices. SP800-22 is not a useful test on output of a cryptographically conditioned RNG as FST-01/NeuG is (its design reportedly uses SHA-256, inspired by NIST SP 800-90B). From an electronic engineering perspective, ChaosKey's noise source based on a reverse-biased BE BJT junction is better defined than the one of FST-01/NeuG. $\endgroup$ – fgrieu Sep 18 '17 at 12:35
  • 1
    $\begingroup$ @fgrieu Thing is transistors don't work backwards for long. Kinda problem for stability further suggesting PRNG not TRNG behavior. Not very professional at all. $\endgroup$ – Paul Uszak Sep 18 '17 at 16:17
  • $\begingroup$ @Paul Uszak: the schematic seems to try to work around the particular problem that you point out: any current in the reverse-biased BE BJT junction of the left transistor goes thru the base of the (normally polarized) right one, wich conducts and reduces said current. I can't tell how well that works to protect the reverse-biased BE junction from long-term damage (migration?), and if it puts the thing in a particularly noisy zone. If this source fails, hopefully there is something in the post-processing to detect it; that's one of the hardest part of RNG design, and a nightmare to test. $\endgroup$ – fgrieu Sep 18 '17 at 16:29
  • $\begingroup$ @PaulUszak That is incorrect. You can have a semiconductor junction that is very stable (as in reliable, obviously unstable) at breakdown voltage. These are called avalanche diodes. $\endgroup$ – forest Jun 30 '18 at 12:39
5
$\begingroup$

If you fish around in your pocket, you can probably find one that costs 0.25 USD.

All it takes to use one of these gizmos is a little patience, a bit of hand-eye coordination, and some confidence that there aren't any surveillance cameras watching you, which you need anyway because you just typed in your password under them to decrypt your laptop's disk.

Once you've warmed it up by flipping it 256 times—or 512 times, just to be on the paranoid side, in case the entropy is ever so slightly below 1 bit per flip—you can get gigabits per second by using the outcome as the seed for an AES-CTR or ChaCha stream.

(You could even drive the cost down to 0.01 USD if you have the extra dexterity, but when the 0.25 USD option will still leave room in your budget for three or four nice dinners including booze, I figure the extra trouble of flipping a penny instead of a quarter isn't worth the 0.24 USD.)

|improve this answer
$\endgroup$
  • 2
    $\begingroup$ Is this another joke? $\endgroup$ – Paul Uszak Sep 17 '17 at 22:57
  • 4
    $\begingroup$ I am always deadly serious. $\endgroup$ – Squeamish Ossifrage Sep 17 '17 at 22:58
  • 2
    $\begingroup$ The issue with this is that it's going to be quite hard to attach a quarter to a small raspberry pie and play with it. Although I get your point :) $\endgroup$ – Jeremy Dicaire Sep 17 '17 at 23:19
  • $\begingroup$ Doesn't the rpi already have an on-board RNG? If you don't entirely trust it to be high-quality, you could combine it with a seed you got by flipping a coin, stored on flash and updated by a one-way function at every boot. (Of course, if you expect it to be actively malicious, then you have deeper problems—you're positing an actively malicious component of the CPU you're asking to handle your secrets.) $\endgroup$ – Squeamish Ossifrage Sep 17 '17 at 23:37
  • $\begingroup$ The magicians at the NSA may have weakened this method of TRNG too, amazon.com/Loftus-Two-Headed-Quarter/dp/B0016ZN17C $\endgroup$ – daniel Sep 18 '17 at 7:40
1
$\begingroup$

What's your definition of

I would like the best open source I can get

OneRNG is designed to be visually verified, and the one complex component can be independently sourced if you don't want to trust the lump of silicon you get in the post from China :-)

Other devices concentrate on usability, form factor, etc. You can't validate that the device you got matches the design so easily, and you can't replace components either because they're so small ...

If someone gives you an executable file and a source file, and asserts that the exe was built from the source, is it "the best open source" if you just take their word for it?

OneRNG is more like a perl script than an executable, you can look at it directly. You can also modify it - you can write your own firmware, although getting it installed will need extra hardware. The analogy doesn't go very far, but I hope you get an idea.

Disclaimer: I'm a member of the OneRNG project.

|improve this answer
$\endgroup$
  • 1
    $\begingroup$ Is OneRNG some hobbit new zelander in joke that us non new zealanders dont get? Also upvote as this is a USB device. $\endgroup$ – daniel Sep 18 '17 at 7:45
  • $\begingroup$ Why should we trust this device if it's own team don't? Why provide the optional radio source? You've also not realised that reverse biased transistors are unstable long term - transistors aren't meant to work backwards. See electronics.SE. And you've not stated the native entropy rate of the source. Are you sure that this is a true TRNG where entropy in > entropy out? I don't believe that it is - it's some sort of pseudo RNG without entropy measurements. And as a commercial product couldn't you get use of even a cheap 'scope or spectrum analyser? $\endgroup$ – Paul Uszak Sep 18 '17 at 10:52
  • $\begingroup$ I saw your team's YouTube presentation. Those guys seemed to not understand the difference between entropy and uniformly distributed random numbers. It's quite a fundamental distinction for wanna be TRNG builders. I'm sorry to be harsh but this one's close to the bone for me. $\endgroup$ – Paul Uszak Sep 18 '17 at 11:02
  • $\begingroup$ @daniel I'd welcome some specific s even if I generally share your sentiment nevertheless $\endgroup$ – Paul Uszak Sep 18 '17 at 11:12
  • 1
    $\begingroup$ @PaulUszak The advice we took at an early stage (after the name was chosen though) was to stick to being an entropy source, and as such the recommended usage of OneRNG is only to be mixed into a pool, not to be used directly. I'm not sure that this is the best place to have an extended discussion, but you'd be welcome to come over to our open mailing list and thrash out detailed responses. $\endgroup$ – Jim Sep 19 '17 at 10:33

Not the answer you're looking for? Browse other questions tagged or ask your own question.