Does watching videos (either online videos such as off youtube or saved locally) generate enough (if any) entropy to create secure encryption keys? I understand that some activities such as memory usage, disk access, network utilization, using the mouse and keyboard, etc... generate entropy under Linux. What I don't know is if using the CPU and GPU also generates entropy? I also don't know if this is the same under Windows.
$\begingroup$
$\endgroup$
1
-
4$\begingroup$ Since humans are bad at generating random numbers your video behavior is not random, either. $\endgroup$– kelalakaMay 3, 2021 at 18:33
Add a comment
|
2 Answers
$\begingroup$
$\endgroup$
4
It does, but it's practically impossible to evaluate how much: just a tiny little bit, or enough for security?
A PC is an extremely complex thing, and it's practically impossible to know its exact state at a precise moment in time, even having observed its external behavior (user actions, network packets…) very precisely. Even knowing the exact state of the CPU alone is very difficult: it's very difficult to build a cycle-accurate simulator for the CPU of a modern PC or smartphone, much more difficult than building a simulator that implements all the operations but not their precise timing. Furthermore such complex chips have multiple clocks, and there is some unavoidable manufacturing imprecision that causes a drift between those clocks (CPU jitter), which is the basis of HAVEGE.
The problem with relying solely on the entropy from jitter (within the CPU and between peripherals) is that it's unreliable. Depending on the system configuration, on how much activity there is, on the ambient temperature, there may be more or less jitter. The entropy from user input is unreliable because the user may be somewhat predictable and may be observable. The entropy from network input is suspect because an adversary may be able to obtain it (e.g. if they control your Internet access because you're in a cybercafé or because they breached your router's 5-year old unpatched firmware).
All of these methods have the problem that shortly after boot, no or little entropy has had time to accumulate; a way to counter this is to save entropy from past runs in a file, and load that at boot time. This way, there may be a lack of entropy during the system installation, but as soon as the system has accumulated enough entropy for security, it keeps that entropy forever.
Operating systems like Linux and Windows mix all the entropy sources inside the kernel and expose it through system calls or similar methods (modern interfaces: getrandom(), BCryptGenRandom(); deprecated interfaces: /dev/urandom, CryptGenRandom()). The entropy you get from those system interfaces is more reliable than anything you could cobble up on your own, and is at least as trustworthy since it's coming from the operating system kernel which you have to trust anyway.
Fortunately modern systems, at least in the PC/smartphone range, have a built-in hardware random generator that is actually designed to produce entropy. The system mixes in all the entropy from various sources, which (barring bugs in the entropy mixing) gives you entropy that's at least as strong as the strongest source. While sources such as user activity and disk jitter are mixed in, it doesn't matter if they don't provide enough entropy, since the hardware RNG is sufficient on its own.
answered May 3, 2021 at 19:41
Gilles 'SO- stop being evil'Gilles 'SO- stop being evil'
18.5k4 gold badges47 silver badges88 bronze badges
-
$\begingroup$ @PaulUszak I know that I emit a certain instruction and it sets a register to a value that I can't predict. I know that others have tried the same thing and come to the same conclusion. Might the random generator be flawed? Sure, it might, but I have no reason to distrust it more than the rest of the CPU. If I'm worried that a CPU might be backdoored, its RNG is the least of my worries: exploiting a backdoored HRNG without another backdoor is not really practical. $\endgroup$ May 3, 2021 at 21:05
-
$\begingroup$ How do you know that CPUs have built-in hardware random generator(s) ? You cannot prove that by visualising the die. See electronics.stackexchange.com/q/311438/56469. Yes, this is a conspiracy theory, or it might be a theory of conspiracy. Read the Times/CNN/WaPo. We are talking about regime change, colonialism and USA first. Think about the concept of computational indistinguishability. This is serious stuff and people get killed. Gilles - I suggest a tag of
Effics. Or is that too erythemal? $\endgroup$ May 3, 2021 at 22:38 -
$\begingroup$ The entropy from network input is suspect because an adversary may be able to obtain it – It's not quite that bad because it's not the network data that's used for generating entropy but the timing of the NIC interrupts, so even an attacker who can monitor all your internet activity won't be 100% effective at deducing the entropy state. But if the attacker is close (e.g. on your router), then they'll be more accurate than if, say, they were monitoring your VPN. Sadly, NIC interrupt coalescing is a thing... $\endgroup$– forest ♦May 3, 2021 at 22:42
-
$\begingroup$ @PaulUszak You do realize that backdooring RDRAND is probably the least effective backdoor that the IC could possibly introduce, right? And I'm pretty sure we do know that it has a built-in RNG. $\endgroup$– forest ♦May 3, 2021 at 22:45
$\begingroup$
$\endgroup$
Or course it does. That's the foundational basis of /dev/random.
I'm not going to repeat what's already well documented. Please read Documentation and Analysis of the Linux Random Number Generator.
What's not really spelt out is where the entropy comes from. It comes from quantization noise. It's the attempt of digital systems to accurately model analogue events. There is also the Observer Effect which is a principal concept in physics. If you measure it, you change it.
The two conflate so that sampling you shoving your mouse about at a resolution of 4 GHz, or 250 trillionth of one second means that good entropy is generated. CPU, GPU, Tablet, mobile phone or washing machine are all the same.
Stick a randomness extractor on the output, and so come your secure encryption keys.
answered May 3, 2021 at 19:23