[Cryptography] An alternative electro-mechanical entropy source (was 'We cannot trust' Intel and Via's chip-based crypto...)

[Bill Cox]

On 12/13/2013 4:26 PM, Arnold Reinhold wrote:
> On Dec 13, 2013, at 1:59 PM, Steve Weis <steveweis at gmail.com 
> <mailto:steveweis at gmail.com>> wrote:
>
>> On Thu, Dec 12, 2013 at 3:44 AM, Arnold Reinhold <agr at me.com 
>> <mailto:agr at me.com>> wrote:
>>> My problem with the Intel design is that there is no way to audit it.
>>> ...
>>> Here is an idea I have been playing with to provide a slow but auditable
>>> source of entropy.
>>> ...
>>> Both the accelerometer chips and the
>>> vibration motors are made in huge quantities and cost under a dollar in
>>> quantity.  They can be audited separately. The items could be 
>>> mounted on the
>>> mother board, daughter board or a USB dongle.
>>
>> A few comments:
>> 1. You aren't trusting the CPU to generate random numbers, but you're
>> trusting the motherboard and chipset that your proposed RNG device is
>> plugged into. You're also ultimately still trusting the CPU which is
>> consuming those values.
>
> The threat I am responding to is devices with no source of randomness 
> other than a RNG buried in the CPU,  presenting a single point of 
> attack that is impossible to detect or prevent. It is an emerging 
> threat as hard drives, which served as a dependable source of entropy, 
> are phased out in favor of solid state devices, and as the internet is 
> increasingly used to control infrastructure with diskless devices.

I like the idea of a completely auditable source of entropy, and the 
accelerometer is clever.  However, why not use zener noise like many 
have done before?  I've used the reverse breakdown of a base-emitter in 
a common N2222 NPN transistor with excellent results - commercial zeners 
are specially designed to be quiet, but no one bothers with a reverse 
Vbe.  Just amplify that with discreet transistors, resistors, and 
capacitors until it's large enough to digitize through an A/D converter, 
and feed that into a cheap PLD for whitening.  Every part of the flow 
along the way is auditable.

I've always wanted to design the entropy source directly into an IC, and 
I'll still do that with my little project, but this conversation has 
convinced me that what we really need for entropy is low tech discrete 
solutions.  Your accelerometer idea is fine, but I'd prefer the bit 
rates I can get from zener noise.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.metzdowd.com/pipermail/cryptography/attachments/20131214/a1acb23a/attachment.html>