1
$\begingroup$

This question relates to NIST Special Publication 800-90B, Recommendation for the Entropy Sources used for Random Bit Generation. A copy is available here.

Can anyone supply a pointer to any publication that has used the entropy assessment techniques of sections 5 and 6? These relate to the characterisation and entropy measurement of non independently & identically distributed data generated by the entropy source of a true random number generator.

By publication I mean some work that is associated with a real TRNG, either DIY, commercial or experimental. I'm not looking for theoretical papers on theoretical TRNGs. The TRNG has to be made of wires and capacitors, not just formulae. I hope that the publication will contain a numerical entropy measurement, most probably << 8 bits per byte or sample.

$\endgroup$
2
  • $\begingroup$ maybe this one? link.springer.com/chapter/10.1007/978-3-662-49301-4_25 $\endgroup$
    – user27950
    Jun 29, 2018 at 10:54
  • $\begingroup$ @Cryptostase The 1.43 bits /4 bits looks exactly like what I was searching for. Is there a free version anywhere? Google can't find one and the previews don't mention NIST. $\endgroup$
    – Paul Uszak
    Jun 29, 2018 at 12:21

1 Answer 1

1
$\begingroup$

What is the purpose of NIST SP 800-90B?

I think you are misunderstanding what NIST SP 800-90B is for. It is not a document explaining how to estimate the quality of a hardware noise source, but rather is meant for validation of a noise source. This means that you will not see it used to return a number of bits per byte. Instead, it will return pass or fail, depending on the quality of the randomness. A source that passes the test will be able to proclaim that it is 800-90B compliant and will be one step closer to being fully FIPS compliant. See section 3 in that paper for more information on that validation process.

To put it simply, there are two steps. The first is a test done in an accredited lab environment where the raw noise source is subject to tests, and the second involves an online test that actively runs as the noise is being collected, prior to conditioning or whitening. The first tests are extensive and are used to check whether or not the noise source lives up to the IID claims made by the manufacturers. The second test is an online test which is constantly run. The online test is part of the implementation and is designed to detect transient failure of the RNG. FIPS requires it shut itself down and refuse to output anything if the test ever fails. The online tests are much simpler than the initial tests as they are run constantly, making performance an issue.

You can run these tests yourself on any raw noise source you have. Post-processing using a simple algorithm is permitted if the source is biased but IID. Only three algorithms are permitted: Von Neuman debiasing, linear filtering, and run length counting. After that, you are free to condition the output using a cryptographic whitener, such as those specified in 800-90A.

A simple overview on one of the drafts for this document is available here.

Who is compliant with 800-90B?

Almost every single product listed on Wikipedia's Comparison of HWRNGs is either directly 800-90B compliant, or is compliant by extension of being FIPS 140-2 compliant. Others are compliant to similar standards such as STS or AIS 31 (which both specify a battery of statistical entropy tests run on pre-whitened, raw hardware noise sources). Some of these have open designs, meaning everything, including the noise source, is public. Others keep that as a trade secret, but publish detailed whitepapers and patents. Perhaps you should look at them.

It is a standard and necessary for FIPS 140-2 compliance, so many TRNGs will be using it. If you have something with a hardware noise source that needs to be FIPS certified, you will see a use of NIST SP 800-90B. At this point, the question becomes Are there any examples of FIPS-certified implementations in which case the answer is yes, many. Microsoft, Intel, Atmel, and even Western Digital have products that are FIPS 140-2 compliant, and thus also NIST SP 800-90B compliant.

If you are looking for a research publication, there are various academic papers that discuss improvements and critiques of the various entropy testing techniques used. For an actual publication going down to the silicon itself, you will probably be out of luck. Those things tend to be considered trade secrets and the most you will see is various whitepapers. In these cases, what you want to look for is whether or not their datasheet or whitepaper claims compliance.

While it is not an academic research paper, here is one concrete example, the TRNG-IP-76:

TRNG-IP-76

Another example may be the ATAES132A, an encrypted EEPROM chip with its own FIPS-certified RNG. Other examples would be the main microcontroller for any number of Opal-certified storage devices, TCG-certified TPMs, various smart cards, or even your CPU itself.

$\endgroup$
6
  • $\begingroup$ The SP 800-90B standard is rather new. Before 2016 , Nist did not have hard requirements regarding the entropy source. That means, all Fips approved products before 2016 do not necessaerly have an entroppy source complient with SP 800-90B $\endgroup$
    – user27950
    Jun 30, 2018 at 10:02
  • $\begingroup$ @Cryptostase There were drafts for quite some time, and other randomness testing requirements existed. But you're right, the standard is fairly new, and the final publication is newer still. $\endgroup$
    – forest
    Jun 30, 2018 at 10:04
  • $\begingroup$ @PaulUszak I am referring to doi.org/10.6028/NIST.SP.800-90B. Dyslexia is no reason to DV. :P $\endgroup$
    – forest
    Jun 30, 2018 at 21:09
  • $\begingroup$ @PaulUszak I consider the raw noise source to be the digitized output of the actual physical hardware, with (non-conditioning) post-processing if necessary for digitization. So a raw noise source may be the run counts captured directly from a reverse-biased zenner diode at breakdown voltage. This is the source that must undergo statistical tests, not the output (which may be conditioned with e.g. CTR_DRBG). These definitions are further specified formally in the document. $\endgroup$
    – forest
    Jun 30, 2018 at 21:43
  • $\begingroup$ Back to confused /dyslexik again then. How can any digitisation of your diode pass any randomness test whatsoever? They will all fail spectacularly. I'm looking for the entropy rate calculation vis a viz NIST section 6, or as per Cryptostase's suggestion. I think we may have to give up on this one. Thanks for the Shuangyi Zhu link; that gives great insight. $\endgroup$
    – Paul Uszak
    Jun 30, 2018 at 22:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.