<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">On Mon, 29 Sep 2014 21:56 ianG <<a href="mailto:iang@iang.org">iang@iang.org</a>> wrote:<br><blockquote type="cite">On 29/09/2014 05:15 am, Bill Cox wrote:<br><blockquote type="cite">One more question, though I think I know the answer, based on "cheap" is<br>the #1 goal:<br><br>I'm using the cheapest FPGA available: a $2 Lattice ICE part with 384<br>LUT/Flops. This is more than enough for interfacing to the USB fifo,<br>but not enough to whiten the signal with cryptographic secrity. I know<br>I need to provide the raw signal without whitening - that can be done in<br>software. However, is there any value in also incorporating a Keccak<br>sponge so that whitening can be done on the USB stick? This would<br>probably require a $4 or $5 FPGA.<br></blockquote><br><br>This is where it gets messy because there are two answers in opposition.<br><br>If we (the buyer/user) are serious enough about using a hardware part<br>then that means we don't trust other parts. Which also means we don't<br>trust your part. So we have to construct a mixer/PRNG that takes inputs<br>from a number of collectors. Your collector being one of them, thanks<br>muchly, and it should be fully uncorrelated with the others.<br><br>Then, because we mix and then plug the result into a PRNG, which<br>typically is guaranteed to have a whitened output, there is no need to<br>whiten your collector output.<br></blockquote><div><br></div>Agreed.<div><br><blockquote type="cite"><br>However, because most devs won't understand the above argument, if you<br>actually supply an unwhitened RNG then geeks will look at it and decide<br>that because they see certain biases in it then it must be broken! And<br>broken they will call it. And broken will be your sales.<br><br>So from a marketing point of view you should put a whitener on the part.<br></blockquote><div><br></div>I disagree here. It’s time we stopped second guessing people and assume other engineers will do their job. Your device should come with a spec sheet characterizing how it deviates from perfectly random, and if possible include some test software intended to distinguish it from a fake device with a PRNG. <div><br></div><div>As i see it, the real need for an inexpensive, high quality TRNG is for disk-less embedded systems, e.g. the Internet of Things. There even $2 can be prohibitively expensive. On the other hand an I2S bus interface is all that is needed, which could let you use a cheaper part. The major IoT use case is generating a unique public/private key pair at first startup, when other entropy sources are not available. But the software for generating public/private key pairs had better be written by someone who knows what they are doing and expecting them to whiten your entropy first is not unreasonable. </div><div><br></div><div>Arnold Reinhold<br><div><br></div></div></div></body></html>