[Cryptography] cheap sources of entropy

[James A. Donald]

On 2014-01-31 20:55, Alan Braggins wrote:
> Or maybe you're running on a virtual machine, and the sound card is 
> being simulated, or shared with every other virtual machine using the 
> same hardware. cf. 
> http://blog.cryptographyengineering.com/2012/10/attack-of-week-cross-vm-timing-attacks.html

Normally only one VM at a time has access to the physical soundcard.

And if two VMs at the same time have access to physical soundcard, that 
still limits your attackers to people who have VMs on the same hardware 
as your system, excluding the other three billion possible attackers.

And you should be using multiple sources of entropy, at least one, and 
possibly several, to exclude each class of attacker.  For example VM 
clockskew will protect you even against attackers on the same machine, 
as will network events, since each VM gets its own network events, and 
hard drive turbulence, since each VM gets its own disk events.

If you are on a VM, probably have a disk drive with turbulence.

If you do not have a disk drive with turbulence, probably have your own 
microphone and video input.

So, get microphone input and clock skew and network events and disk 
drive turbulence and hash them all together.  One of them is bound to 
work.  The class of machines on which one of these fails is different 
from the class of machines on which another of them fails.