[Cryptography] An alternative electro-mechanical entropy source (was 'We cannot trust' Intel and Via's chip-based crypto...)

[Arnold Reinhold]

On 14 Dec 2013 08:04 Bill Cox wrote:
> On 12/13/2013 4:26 PM, Arnold Reinhold wrote:
>> On Dec 13, 2013, at 1:59 PM, Steve Weis <steveweis at gmail.com 
>> <mailto:steveweis at gmail.com>> wrote:
>> 
>>> On Thu, Dec 12, 2013 at 3:44 AM, Arnold Reinhold <agr at me.com 
>>> <mailto:agr at me.com>> wrote:
>>>> My problem with the Intel design is that there is no way to audit it.
>>>> ...
>>>> Here is an idea I have been playing with to provide a slow but auditable
>>>> source of entropy.
>>>> ...
>>>> Both the accelerometer chips and the
>>>> vibration motors are made in huge quantities and cost under a dollar in
>>>> quantity.  They can be audited separately. The items could be 
>>>> mounted on the
>>>> mother board, daughter board or a USB dongle.
>>> 
>>> A few comments:
>>> 1. You aren't trusting the CPU to generate random numbers, but you're
>>> trusting the motherboard and chipset that your proposed RNG device is
>>> plugged into. You're also ultimately still trusting the CPU which is
>>> consuming those values.
>> 
>> The threat I am responding to is devices with no source of randomness 
>> other than a RNG buried in the CPU,  presenting a single point of 
>> attack that is impossible to detect or prevent. It is an emerging 
>> threat as hard drives, which served as a dependable source of entropy, 
>> are phased out in favor of solid state devices, and as the internet is 
>> increasingly used to control infrastructure with diskless devices.
> 
> I like the idea of a completely auditable source of entropy, and the 
> accelerometer is clever.  However, why not use zener noise like many 
> have done before?  I've used the reverse breakdown of a base-emitter in 
> a common N2222 NPN transistor with excellent results - commercial zeners 
> are specially designed to be quiet, but no one bothers with a reverse 
> Vbe.  Just amplify that with discreet transistors, resistors, and 
> capacitors until it's large enough to digitize through an A/D converter, 
> and feed that into a cheap PLD for whitening.  Every part of the flow 
> along the way is auditable.
> 
> I've always wanted to design the entropy source directly into an IC, and 
> I'll still do that with my little project, but this conversation has 
> convinced me that what we really need for entropy is low tech discrete 
> solutions.  Your accelerometer idea is fine, but I'd prefer the bit 
> rates I can get from zener noise.

I like Zener/avalanche noise as a source and have links to several designs on my web page http://www.std.com/~reinhold/truenoise.html.  Here is another nice wide band design from some RF guys that I recently came across.: http://code.google.com/p/opendous/wiki/Upconverter_NoiseSource

But I am looking for something more off-the-shelf and as inexpensive as possible. Everyone here seems to agree that the right approach is to use more than one source of entropy, but this is becoming difficult as devices are fielded with only one source, the CPU or SoC.  I'm not aware of any commercial system that has two purpose-built noise sources now. Getting vendors to include a second source will be challenging and every penny counts. Ultimately, I'd like to see a requirement for dual independent sources incorporated into industry standards like SP-800-90, but any such proposal will get a lot of industry pushback if the added expense is significant.

So I am trying to come up with several robust solutions, generators that could fit on a thumbnail-sized DigiSpark, shield for example. Someone else on this thread suggested feeding an analog output into an analog input and relying on the low-order-bit measurement noise.  I'm not sure how much to trust that approach, but it's should easy to try. I'm thinking of including a thermistor in the voltage divider to get some physical variability that can be tested.  

But accelerometers seem the best so far. Thy are cheap, widely available from several manufacturers and are easy to interface. They could also serve a second purpose as an tamper attempt detector. One could even afford to include two accelerometers from different manufacturers and compare their outputs as a check.  

Arnold Reinhold


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.metzdowd.com/pipermail/cryptography/attachments/20131216/63243849/attachment.html>