<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">On 14 Dec 2013 08:04 Bill Cox wrote:<div><blockquote type="cite">On 12/13/2013 4:26 PM, Arnold Reinhold wrote:<br><blockquote type="cite">On Dec 13, 2013, at 1:59 PM, Steve Weis <<a href="mailto:steveweis@gmail.com">steveweis@gmail.com</a> <br></blockquote><blockquote type="cite"><<a href="mailto:steveweis@gmail.com">mailto:steveweis@gmail.com</a>>> wrote:<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite"><blockquote type="cite">On Thu, Dec 12, 2013 at 3:44 AM, Arnold Reinhold <<a href="mailto:agr@me.com">agr@me.com</a> <br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><<a href="mailto:agr@me.com">mailto:agr@me.com</a>>> wrote:<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><blockquote type="cite">My problem with the Intel design is that there is no way to audit it.<br></blockquote></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><blockquote type="cite">...<br></blockquote></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><blockquote type="cite">Here is an idea I have been playing with to provide a slow but auditable<br></blockquote></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><blockquote type="cite">source of entropy.<br></blockquote></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><blockquote type="cite">...<br></blockquote></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><blockquote type="cite">Both the accelerometer chips and the<br></blockquote></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><blockquote type="cite">vibration motors are made in huge quantities and cost under a dollar in<br></blockquote></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><blockquote type="cite">quantity. They can be audited separately. The items could be <br></blockquote></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><blockquote type="cite">mounted on the<br></blockquote></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><blockquote type="cite">mother board, daughter board or a USB dongle.<br></blockquote></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">A few comments:<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">1. You aren't trusting the CPU to generate random numbers, but you're<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">trusting the motherboard and chipset that your proposed RNG device is<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">plugged into. You're also ultimately still trusting the CPU which is<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">consuming those values.<br></blockquote></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">The threat I am responding to is devices with no source of randomness <br></blockquote><blockquote type="cite">other than a RNG buried in the CPU, presenting a single point of <br></blockquote><blockquote type="cite">attack that is impossible to detect or prevent. It is an emerging <br></blockquote><blockquote type="cite">threat as hard drives, which served as a dependable source of entropy, <br></blockquote><blockquote type="cite">are phased out in favor of solid state devices, and as the internet is <br></blockquote><blockquote type="cite">increasingly used to control infrastructure with diskless devices.<br></blockquote><br>I like the idea of a completely auditable source of entropy, and the <br>accelerometer is clever. However, why not use zener noise like many <br>have done before? I've used the reverse breakdown of a base-emitter in <br>a common N2222 NPN transistor with excellent results - commercial zeners <br>are specially designed to be quiet, but no one bothers with a reverse <br>Vbe. Just amplify that with discreet transistors, resistors, and <br>capacitors until it's large enough to digitize through an A/D converter, <br>and feed that into a cheap PLD for whitening. Every part of the flow <br>along the way is auditable.<br><br>I've always wanted to design the entropy source directly into an IC, and <br>I'll still do that with my little project, but this conversation has <br>convinced me that what we really need for entropy is low tech discrete <br>solutions. Your accelerometer idea is fine, but I'd prefer the bit <br>rates I can get from zener noise.</blockquote><div><br></div>I like Zener/avalanche noise as a source and have links to several designs on my web page <a href="http://www.std.com/~reinhold/truenoise.html">http://www.std.com/~reinhold/truenoise.html</a>. Here is another nice wide band design from some RF guys that I recently came across.: <a href="http://code.google.com/p/opendous/wiki/Upconverter_NoiseSource">http://code.google.com/p/opendous/wiki/Upconverter_NoiseSource</a></div><div><br></div><div>But I am looking for something more off-the-shelf and as inexpensive as possible. Everyone here seems to agree that the right approach is to use more than one source of entropy, but this is becoming difficult as devices are fielded with only one source, the CPU or SoC. I'm not aware of any commercial system that has two purpose-built noise sources now. Getting vendors to include a second source will be challenging and every penny counts. Ultimately, I'd like to see a requirement for dual independent sources incorporated into industry standards like SP-800-90, but any such proposal will get a lot of industry pushback if the added expense is significant.</div><div><br></div><div>So I am trying to come up with several robust solutions, generators that could fit on a thumbnail-sized DigiSpark, shield for example. Someone else on this thread suggested feeding an analog output into an analog input and relying on the low-order-bit measurement noise. I'm not sure how much to trust that approach, but it's should easy to try. I'm thinking of including a thermistor in the voltage divider to get some physical variability that can be tested. </div><div><br></div><div>But accelerometers seem the best so far. Thy are cheap, widely available from several manufacturers and are easy to interface. They could also serve a second purpose as an tamper attempt detector. One could even afford to include two accelerometers from different manufacturers and compare their outputs as a check. </div><div><br></div><div>Arnold Reinhold</div><div><br></div><div><br></div></body></html>