Is Intel's RDSEED a true random number generator?

  • $\begingroup$ I removed your question about the software implementation. Implementation questions should be asked on Stackoverflow. $\endgroup$ Jun 26 '19 at 7:44

Yes, RDSEED is a true random number generator.

From Wikipedia:

The entropy source for the RDSEED instruction runs asynchronously on a self-timed circuit and uses thermal noise within the silicon to output a random stream of bits at the rate of 3 GHz [...].

RDSEED is however used as a seed for (software implemented) PRNGs of arbitrary width.

  • 2
    $\begingroup$ I would say that we need to be pretty careful with citing Wikipedia. Unless the text is backed up by credible sources, we should probably tread with caution. Come to think of it, some of what we read, especially on sensitive topics such as cryptography, may be misinformation. $\endgroup$
    – Patriot
    Jun 28 '19 at 11:59

No one knows, so we can't say because of the two obstacles of non auditability and computational indistinguishably. But it's not looking good at all.

Since the device is completely unverifiable, it could do anything. All we know for certain is that it is impossible to mathematically verify true randomness. Computational indistinguishably means that the output could simply be any decent $ \operatorname{E}_{k \; \oplus \; cpuid} (ctr) $ like CSPRNG. Intel state that it's AES-CBC-MAC throughout anyway.

Wikipedia is not the oracle of all truth, and has to be ignored in this context. The primary verification of the device is ANALYSIS OF INTEL’S IVY BRIDGE DIGITAL RANDOM NUMBER GENERATOR. That was followed up with an academic report, A Provable-Security Analysis of Intel’s Secure Key RNG. Unfortunately for users, both reports are based on a raw entropy rate of ~0.5 bits/bit. And to be a gold standard TRNG, (entropy out) < (entropy in). But it says in those reports:-

"We did not have access to Ivy Bridge parts, so Intel provided us with testing data from pre-production chips. These chips allow access to the raw ES output, a capability which is disabled in production chips. "

The whole analysis is built on sand. Many factors create reasons for suspicion:-

  1. It is not in the interest of the US government/NSA/security community to produce fast secure random number generators for public use. Cui bono?
  2. The NSA has form on this, with many examples publicly available.
  3. All public analysis of the chip is based on unverified data samples supplied by Intel themselves. Is ~0.5 bits/bit real?
  4. The primary analysis of RDSEED was paid for by Intel which is a huge conflict of interest, tantamount to marking your own homework. From that report's front page - "This report was prepared by Cryptography Research, Inc. (CRI) under contract to Intel Corporation".
  5. The entropy source operates at a suspiciously high 3GHz. Academic laboratory TRNG's have only recently attained this rate using optical means (green line below). If true, I would expect huge correlation at this sample rate. Injecting 1% entropy into a CSPRNG stream does not make a TRNG.
  6. The pink marked devices show how easy/common it is to over-hype your TRNG. These marked devices have exceeded a very conservative engineering limit (Shannon-Hartley) beyond which it is mathematically impossible to extract any more entropy. Some others appear to be suspiciously right on the limit. limits From Recommendations and illustrations for the evaluation of photonic random number generators.
  7. The entropy source is an atypical circuit not replicated in the hacker community, and the only detailed analysis is by Intel themselves and unpublished. (C. E. Dike, "3 Gbps Binary RNG Entropy Source," Intel Corporation (unpublished), 2011.)
  8. The typical completely in-silicon TRNG is synthesised via multiple ring oscillators. Inverters are easy to burn in their hundreds. There are numerous examples at all levels of academia and commerce. Intel chose not to for some reason, preferring to go analogue on an otherwise entirely digital die.
  9. There is no raw entropy source available for inspection, and even if there was, the level of integration means that we can't verify that the source is actually used.
  10. *nix developers do not trust it.

But the best for last. Even Intel could not convince it's own agent that it's a good TRNG:-

Under heavy load, it should provide security equivalent to 128-bit AES, even against an attacker who can see some of its outputs and, after a good reseed, force the ES to output nonrandom, known values.

-Cryptography Research, Inc. (CRI).

If you accept that an effective TRNG has information theoretic security via the entropy input/output ratio, Intel's isn't. Given all the evidence against, and who benefits if it isn't, I have to conclude it's a CSPRNG (at best), and not a TRNG. Most of the *nix community agrees with me.

  • 1
    $\begingroup$ I'd consider that "it's too uncertain to be used as a TRNG" a better phrase. It could very well be a TRNG (and personally I expect it to be so, if just because of the fallout produced if it isn't). However I agree that it certainly hasn't been proven to be one beyond reasonable doubt. In the end though it is a TRNG - or an RNG based on a TRNG - or it isn't, and that doesn't depend on opinion. $\endgroup$
    – Maarten Bodewes
    Jun 28 '19 at 10:54
  • 1
    $\begingroup$ Although there are some good points in this answer, the last paragraph is nonsense. A TRNG has no inputs, and the RDSEED chip has no inputs. It's most definitely not a CSPRNG: there is an entropy source, and the question here is the quality of this entropy source. The cited sentence from CRI does say that it's a good TRNG, providing sufficient entropy against a reasonably powerful attacker. As you note this is a biased source, but it doesn't at all say what you claim it says. $\endgroup$ Aug 2 '19 at 6:46
  • $\begingroup$ @Gilles Great comment! Why do you believe that my direct quotation isn't? The I/O ratio relates to the Shannon-Hartley criteria across the extractor. This is where true magic can exist. And we know nothing of the source and/or biases as it can't be audited. I'd have thought that you'd have known the construct's dodgy from your Unix persona. All the development influencers have abandoned RDThing. It's pretty clear they're right to do so. $\endgroup$
    – Paul Uszak
    Aug 2 '19 at 10:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.