Household sources of secure randomness?

Question

In my home, I have a coin. I can use that coin to generate random bits. These bits are mostly secure unless someone is watching me flip it. They're also only random-ish... maybe I'm a "bad flipper"?

I also have a computer. I can use it to generate bits that are sort of random, but not really. These are secure if you trust the algorithm and the machine. /shrug

I'd like to generate random numbers with the materials I have at hand, and for them to be secure. Can I do better than a coin flip in terms of security or randomness?

Answer 1

• PC based;

  • If you have /dev/urandom as in Linux or file:/dev/urandom on Windows you can use them to derive randomness in an off-line system.

    The programming languages like Python have a module secret that enables to access the system's secure randomness. See other programming languages documents.

    Be careful when using the /dev/random it has some details to be considered.

    And, don't be a Monkey to derive the randomness if ever a program asks you.

• Physical objects

  • LavaLamp
  • 6 or 24-faced dice.
  • Fishtanks as Kodlu said in the comments.
  • To be honest, coin flipping is the obvious choice if you have such a coin flipping machine
  • White noise TV - may need special care;
  • Random picture from a channel; used in movie Johnny Mnemonic.

• Extra physical

  • If you have enough money, enthusiasm, and knowledge, you can use Quantum based random number generators, too.

• Mind based

  • be a Russian to generate (not truly) random numbers. They used to generate for OTP keys.
  • Remember humans are bad at generating random numbers.

Answer 2

I recommend that unless you're especially paranoid and don't trust modern cryptographic algorithms like block and stream ciphers or hashes, you should use your PC. It's the easiest approach by far.

It either has \dev\urandom for *nix machines, or the random number generator from the new Windows' (Windows Server 2008 and Windows Vista and later) Cryptography API: Next Generation (CNG). A lot of programming languages wrap these two sources up into easier to use functions/libraries.

Both are pseudo random number generators providing a perfectly acceptable security level. And they are pretty much endless in output so should suffice for all non one time pad applications. Computational indistinguishability means that it is infeasible to distinguish their outputs from a truly random distribution.

If you are a tin foil hat type (I am), I suggest that you review the random number generator, randomness and one time pad tags. That use case is too involved to post as a single general answer.