Hot answers tagged

34 votes

Why is the output of a True Random Number Generator (TRNG) insecure after it has been compressed?

I think you're misinterpreting the source. The source says the TRNGs "rely" on compression (a cryptographic hash would be the compression function, or possibly some simpler function to ...
user avatar
  • 1,381
11 votes
Accepted

What issues are there while using Linux's /dev/urandom for generating cryptographic keys?

Using /dev/urandom to generate cryptographic keys or secrets can be an issue when the state of the OS is not unique. This is the typically case when a VM was just ...
user avatar
10 votes
Accepted

Doing OTP two or more times with a biased TRNG: Will this have the same security as if was done with a non-biased TRNG?

Better than using it once, but not as good as an unbiased TRNG. To see this, suppose our TRNG is very biased, producing a zero 10% of the time and an one 90% of the time. If we use the TRNG twice, for ...
user avatar
  • 1,370
8 votes

Are my random numbers really "bad" or is that a statistical effect which "must" happen from time to time?

One of the failing test discussed in the question was coded for the purpose. It could be useful to validate that code using a known-good pseudo-random source (the output of SHA-256 for incremental ...
user avatar
  • 122k
8 votes

Will OTP provide quantum resistance under 5 conditions?

That sounds more difficult than it is in fact. You could build one using light, heath, or a semiconductor that will produce certified noise but it will never be NIST certified. (But that is obviously ...
user avatar
  • 84.5k
8 votes

Doing OTP two or more times with a biased TRNG: Will this have the same security as if was done with a non-biased TRNG?

The convergence of your suggested process towards unbiased bits is guided by the Piling Up Lemma. It will be slow. It is more efficient to use unbiasing procedures such as von Neumann unbiasing. See ...
user avatar
  • 16.1k
7 votes

Differences between methods of hardware random number generators

The Electrical Engineering SE would be a good resource for questions about specific sources of noise. Which method is best is not a a question for which you will find a good answer to. The "quality" ...
user avatar
7 votes
Accepted

Random number generator issue

Both ent tests distinguish the files from random data with high confidence (99.84% for the bit test, >99.99% for the byte test). That follows from the "randomly ...
user avatar
  • 122k
6 votes
Accepted

Perform ENT / Dieharder on raw entropy or on whitenened entropy?

It depends on the goal of performing the test: If the goal is to test for a problem in the whitening, then the test should be run on the whitened output, of course. If the test fails (more often than ...
user avatar
  • 122k
6 votes

Random number generator issue

We can't tell how you get from a binary 16 bit timer to a file full of bits. Have you simply stored the timer values? I'm assuming that the file type is wrong though, in that the files are actually ...
user avatar
  • 13.8k
6 votes
Accepted

When is an RNG a CSPRNG, a CSRNG, or a TRNG?

There seems to be a lot of confusing terminology here. Let me define everything to the best of my knowledge. RNG: Some mechanism that produces random numbers. CSRNG: An RNG that is safe for ...
user avatar
  • 2,337
5 votes

Open-source usb TRNG and US standards - Help choosing

If you fish around in your pocket, you can probably find one that costs 0.25 USD. All it takes to use one of these gizmos is a little patience, a bit of hand-eye coordination, and some confidence ...
user avatar
5 votes
Accepted

What is proper use of a True Random Number Generator?

I assume your TRNG has a uniform distribution and can generate all possible 32bit numbers (ie. isn't limited to a specific smaller number range, just to [0,2^32-1]). In this case, it doesn't really ...
user avatar
5 votes

Usage and limitations of sponge functions for PRNG

I'd say the comparison table is not a fair one, as it compares the Infinite Noise generator's throughput when feeding bits into a CSPRNG (Keccak) running on the host workstation and then running that ...
user avatar
  • 2,217
4 votes
Accepted

Usage and limitations of sponge functions for PRNG

The only reason to use /dev/random is to wait until the system has loaded entropy. If you have waited once, it is generally safe to use /dev/urandom. It has nothing whatsoever to do with speed of ...
user avatar
4 votes

Is RDSEED a true RNG?

Yes, RDSEED is a true random number generator. From Wikipedia: The entropy source for the RDSEED instruction runs asynchronously on a self-timed circuit and uses thermal noise within the silicon ...
user avatar
  • 6,316
4 votes
Accepted

Verifying randomness and uniqueness of TRNG output

There is no such thing as a random number and as such it is a category error to attempt to verify whether a particular set of numbers is ‘random’. There are random generators of numbers; the relevant ...
user avatar
4 votes
Accepted

Is a LFSR sufficient for post-processing a biased TRNG?

I'll assume the right 16 in the question's figure is to tell that the LFSR is unloaded 16 bits at a time; and unless otherwise stated I'll assume that's done every 16 clock cycles of the LFSR. Is the ...
user avatar
  • 122k
4 votes

How to compute the dataset size required by dieharder tests?

I'll be so bold as to say that no one knows for sure how much data you really need. There is no guidance on the homepage, the manpage and this thread from Duke is equally unspecific. Anecdotal ...
user avatar
  • 13.8k
3 votes

Perform ENT / Dieharder on raw entropy or on whitenened entropy?

Ideally a whitening algorithm passes data through cryptographic algorithms, rather than doing something simple (like Von-Neumann's unfair coin de-biasing algorithm or reading the least significant bit ...
user avatar
3 votes
Accepted

Differences between methods of hardware random number generators

Treating each in turn without too much electronics stuff:- Analog-to-digital converter noise Better known as quantization noise, is very simple as you can just leave an ADC input floating and the ...
user avatar
  • 13.8k
3 votes

What are known metrics for TRNG?

The one metric that generically matters in cryptography for a physical entropy source is the min-entropy: the exponent of the most probable outcome, in bits. This depends on the physics of the ...
user avatar
3 votes

Are my random numbers really "bad" or is that a statistical effect which "must" happen from time to time?

How many patterns are you testing? If you are looking for many different patterns. It is expected that at least one of them would be more common. Normally we want the p value to be small to show an ...
user avatar
  • 10.4k
3 votes

What is proper use of a True Random Number Generator?

The contract of a true random number generator is that: Every bit it outputs has an equal chance of being a zero as a one; Knowledge of the values of any of the bits it has output in the past is of ...
user avatar
3 votes

Public Randomness-Based Random Number Generator using Mobile Phone?

Be careful about the phrase “True Random Number Generator”. There's a bit of hype in that phrase. You do not need to use a TRNG directly to do things like generate cryptographic keys — in fact, you ...
user avatar
3 votes

Digital Certificates genereted from Hardware Security Module

HSMs are not purchased just for the feature of generating certs. HSMs also store the certificates very securely. You cannot use the cert in the HSM unless you are authorised HSMs also provide very ...
user avatar
  • 1,678
3 votes

When is an RNG a CSPRNG, a CSRNG, or a TRNG?

(Disclaimer: I wrote the passage quoted in the question.) Can an RNG which relies — among other things — on a non-deterministic physical noise source still be called "pseudo" random? I would ...
user avatar
3 votes
Accepted

Hardware Gaussian random numbers for lattice-based cryptography

You are confusing discrete Gaussian sampling with Gaussian sampling. A discrete Gaussian of parameters $\mu, \sigma$ is a random variable supported on $\mathbb{Z}$ with pmf: $$\Pr[X = k]\propto \exp(-\...
user avatar
  • 8,424
3 votes

Will OTP provide quantum resistance under 5 conditions?

As explained in comment and the other answer, "If any deterministic algorithm is used" as in the question's condition 5, then the cryptosystem is not a One Time Pad, it is a cipher; a stream ...
user avatar
  • 122k
3 votes

Doing OTP two or more times with a biased TRNG: Will this have the same security as if was done with a non-biased TRNG?

Pretty much yes. Many TRNG designs are based entirely on digital circuitry, and do not involve any analogue components [see note]. It makes them simpler to incorporate on silicon. But unfortunately ...
user avatar
  • 13.8k

Only top scored, non community-wiki answers of a minimum length are eligible