Are the GPS coordinates (latitude and longitude) a good source of entropy? If yes, why? If no, why?

The question would investigate on the fact if the GPS location data can be used as source of entropy in the cryptography field, in general. The question could be trivial or not, it depends by several factors (e.g. the scenario, the entity speed and so on).

But what do you think about it?

  • 2
    $\begingroup$ No, because GPS coordinates have no random aspect, they're just where the receiver is and will not change significantly. $\endgroup$
    – Marc
    Aug 5 '20 at 6:58
  • $\begingroup$ To clarify: if you can get a good estimate of the random source just by observing the receiver, it's no longer random. You could use the noise part of the signal iff you have a good notion of how random it is but then it's no longer GPS coordinates, it's radio noise. $\endgroup$
    – Marc
    Aug 5 '20 at 7:33
  • $\begingroup$ @Marc exactly. I'm referring only to latitude and longitude and not to the intrinsic properties of the GPS signal. $\endgroup$
    – CipherX
    Aug 5 '20 at 8:02
  • $\begingroup$ Then no, your adversary will know entirely too much about your random source just by knowing where you are, even if you're moving. $\endgroup$
    – Marc
    Aug 5 '20 at 8:04

Probiably not. If a hacker where to locate the device physicaly then the search space would be greatly decreased. Even knowing the city (ip can give you that) might be enough. Other similar sources with a higher entropy could be changes in lat and long, but those are most likely small. You would most likely get better entropy using the accelerometer/gyrometer/magnomiter instead (if avaliable, I am assuming this is for a phone). If you wanted lots of entropy, you could ask the user to give their phone a nice toss while poling gyro and acceleration.

  • $\begingroup$ What if one uses the least significant bits? That is changing a lot faster than MSB. $\endgroup$
    – kelalaka
    Aug 5 '20 at 14:52
  • $\begingroup$ That would be better than the entire position, but you have fewer bits that way so you would have to sample over a longer time. $\endgroup$ Aug 5 '20 at 20:41

I think you're running into a conceptual misunderstanding here and looking to extract entropy from values that are better understood as a signal (your GPS's estimate of your position) instead of trying to isolate a noise (e.g., the errors in your GPS's estimate of your position).

For example, one idea that's discussed from time to time is the use of digital cameras—already built into tons of devices—as an entropy source. But the idea, in its more clueful implementations, isn't to use the variability of real-life scenes and try to turn that into random bits, but rather, to isolate the sensor noise from the actual scene and extract entropy from that noise. One simple way of doing this is to actually take two consecutive photos with no light hitting the sensor, so that the differences between the two frames are random noise.

Transporting this idea into the GPS realm, if you want to extract entropy out of GPS you wouldn't want to use the locations per se, which as other folks have pointed out is likely something your adversary can predict. Rather, you'd want to identify some factors that cause random errors in your GPS receiver's estimates of your location, and see if from that you can produce sequences of values that fluctuate randomly.

If we get a bit closer to basics, though, note that:

  1. GPS satellites are orbital atomic clocks;
  2. The GPS position fix is actually a position and time fix;

Which does suggest an approach: instead of GPS position, use GPS time as a reference to successively measure the errors of an independent clock on your device (e.g., the system monotonic clock) and extract your random bits from that.

  • $\begingroup$ Algorithms, once implemented, often outlive their intended life. Levels of precision that today are roughly random, such as portions of a position that represent millimetres or less, might indicate true position in the future. So an algorithm would somehow have to make repeated measurements, and distinguish noise from actual movement of the sensor. $\endgroup$ Aug 5 '20 at 22:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.