4
$\begingroup$

Let's say I have a true random number generator TRNG. Random numbers are generated on demand from a HW-entropy source, resulting in a 32-bit random value each time it is called.

I have to fill an array of 10 Bytes (=10*8 bits= 80 bits) with random numbers. Can I make a first call to TRNG, take the fist byte, the second, the third and the fourth to fill my array, and then call again...

Or should I call a new random number for each byte and throw away the non used bytes?

I would say the first approach is correct, but there is a slight issue with random number quality in my project and I want to be sure - maybe I'm completely wrong...

Improve this question
$\endgroup$
4
  • 3
    $\begingroup$ The only thing I'd use a TRNG for is to generate seed material for a CSPRNG. $\endgroup$
    – CodesInChaos
    Feb 13, 2018 at 16:02
  • $\begingroup$ @CodesInChaos What encryption keys? It's not easy to create a password with 256 bits of measured entropy. And one time pads (recently in vogue on this forum)? $\endgroup$
    – Paul Uszak
    Feb 13, 2018 at 22:23
  • $\begingroup$ @CodesInChaos In embedded devices a TRNG could be much faster than a CSPRNG. Would you advise the same on such devices ? $\endgroup$
    – Ruggero
    Feb 14, 2018 at 9:38
  • $\begingroup$ A TRNG is almost always going to be slower than a CSPRNG, even in embedded devices. Pretty much every decent "TRNG" is actually a CSPRNG (often a stream cipher) with an entropy source to re-key it anyway. That's the easiest way to perform whitening to ensure uniform, non-biased non-correlated output. The whole thing may be implemented in hardware, of course. $\endgroup$
    – SAI Peregrinus
    Feb 14, 2018 at 23:42

3 Answers 3

Reset to default
5
$\begingroup$

I assume your TRNG has a uniform distribution and can generate all possible 32bit numbers (ie. isn't limited to a specific smaller number range, just to [0,2^32-1]).

In this case, it doesn't really matter, because the TRNG output is also a stream of truly random single bits, as well as a stream of truly random 2bit pairs (numbers 0-3), etc.
If this were not true, ie. your 32bit numbers are uniformly random but the single bits are not, it wouldn't be possible: Take the first 32bit number, then see what bits it has, and you already have information about some bits of the next numbers, meaning the full number isn't ranodm either.

So, if you take just a part of one 32bit dataset, it doesn't mean that the rest is less random anymore. Just use the rest too.

Improve this answer
$\endgroup$
3
$\begingroup$

The contract of a true random number generator is that:

  1. Every bit it outputs has an equal chance of being a zero as a one;
  2. Knowledge of the values of any of the bits it has output in the past is of no help for guessing the value of any bit it will output in the future.

These two properties are enough to settle your question; they imply that generating four random bytes from a single, random 32-bit word is correct.

Improve this answer
$\endgroup$
1
$\begingroup$

Can we assume that the TRNG has been tested /certified for randomness? You can take the 80 bits in any systematic way from the TRNG without loss of randomness. Split the 32 in 4 groups of 8, take the least significant byte or even call up 80 x 32 bit numbers and take one bit from each. Just don't pick them by looking at their values and think "that looks more random" as it invariably won't be. All the bits should be uniformly distributed and independent of each other.

As an aside, if you're only looking for 80 bits in a one off (or very infrequently), you can just pull them out of /dev/random which should be adequate for most. This way you don't actually need the hardware TRNG at all. Your stock computer can act as the TRNG. Do the following after checking your email and updating your Facebook status:-

dd if=/dev/random of=random_bits bs=1 count=10 iflag=fullblock

Keyboard and mouse interaction is the quickest means to input entropy into your computer's kernel. You'll soon have a good 80 bits, perhaps even immediately if you've not been sucking on /dev/random earlier.

Improve this answer
$\endgroup$
1
  • $\begingroup$ Comments are not for extended discussion; this conversation has been moved to chat. $\endgroup$
    – SEJPM
    Feb 23, 2018 at 15:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.