random number generator 10-side dice alternative

Question

A lot of sites (e.g. Dirk Rijmenants') refer to 10-side dice to generate random number for one-time-pad. I was thinking about new ways to generate random numbers, letters and passwords. here what I got…

To generate random numbers:

• Take out keys numbers from 0-9 from old keyboard, calculator or mobile pad and put it in a cup shake it then take one out write it on paper threw it back, shake, and take another... so on till get my numbers.

To generate random letters for OTP:

• Take out letters key from an old keyboard put them in a cup shake it and take one out write it on paper then threw it back, shake and take another one... repeat till get my otp letters.

To generate random passwords:

• take out letters key from black keyboard (for small letters) and another one white for capital letters, symbols/numbers keys black keys for symbols, white for numbers, then put all keys (72 keys) in a hat, shake it and take one key out write it down throw it back shake, take another one... untill I get my true random password.

Can any one confirm that way as a true random numbers, letters and passwords generator?

Answer 1

One problem is that keyboard keys may or may not be uniform. Look at the F and J keys - they may have a little dot of plastic to identify them with your fingertips. That little dot may make them heavier or lighter than other keys, affecting how they shake up in a hat. Some keyboards, like Das Keyboard, were built with different spring actions for different keys, which might or might not affect the weight or shape of each key. And some keyboards have larger curvatures for various key tops, and those keys definitely have different mass.

The problem is that creating perfectly symmetric keys is not a design goal for keyboard designers, so without studying and measuring each keyboard, you won't have assurance that any particular keyboard is suitably random for your purpose.

They may also be just fine if you are not looking to generate thousands of passwords. If you're concerned, though, consider repurposing a device designed to generate random values. A bingo cage could be refilled with 26 hand lettered balls. Playing cards could have handwritten letters and shuffled extensively. A 100-sided dice could be repainted to match your character set, and extra values blacked out to indicate "roll again".

See also "diceware" for a way to turn 6 sided dice into passwords.

Answer 2

Dice have been extremely well studied (having been used for gambling for, well, thousands of years). It is hard to beat them, for simplicity and bandwidth of random number generation, if you want to avoid use of computers for random number generation.

Dice have three advantages. First, it's pretty fast to roll dice. Second, they are familiar; people understand dice, and understand why they are random. Third, they have good randomness properties: we've been using them for centuries for gambling, and we've worked out most of the serious bugs that affect their randomness. If you want especially good quality, you can buy casino-grade dice -- the same dice used in casinos, so you have pretty good assurances that they have good randomness (casinos are relying upon them, to the tune of millions of dollars each year).

I don't think taking out letter/number keys from a keyboard and drawing them out of a hat is going to work as well, in terms of efficiency. But you could always try the experiment (try drawing 100 numbers using 10-sided dice, then by drawing number keys from a hat, and see which took longer) and report back.

Answer 3

The method (shake well, take out one keycap, put it back, repeat) will provide 'high' quality randomness.

All keycaps must be of the same size, weight etc.! So cheap, flat keyboards may be a better choice than curved ones ("natural", "ergonomic" ...).

You can also use a cotton bag, large enough to stretch out your fingers while inside. if you insist on cups and hats, use the bag just to store/transport your TRNG.

To test, make at least a few thousend draws. With dice, a few hundred rolls per dice will show all but (very) small imperfections (cheap ones from a toy store; casino grade dice need more rolls to test).

Using the black&white approach using A-Z, a-z, 0-9, dot (.) and dash (-) gives you 6 bit per single draw. Using dice, 6 bit require two rolls off a dice plus a third roll to decide letter case or '0/.', '1/-'. 6x6 matrix, roll the row, then the column, and, if applicable [a-z01], the case ("uppercase" 0 dot, 1 dash).

Dice are available almost everywhere. Salvaging keyboards takes time to find suitable ones in the first place.

Answer 4

No, it will not produce quality random numbers, in the same way that shuffling a deck of cards will not produce a randomly shuffled deck. If two keys are next to one another when you start shaking, they will quite likely be next to one another when you stop shaking.

If I know one value from your random number generator, I can learn information about other values from your random number generator, whether they come before or after.