Smoke detectors have small harmless radioactive sources. Why don't you use that as the basis for a hardware PRNG?
Because I didn't have one handy!
Seriously though the radioactive Americum smoke detectors are old and have largely been phased out (from what little I know) and may be hard to find for most people, whereas the mains noise based system is neat and self-powered and accessible to almost everyone worldwide that might need some random numbers.
WTPpepper said:
...
Written by academics and a Professor. Sorry. I am neither. I have however worked in the Maths/Electronics/Crypto industry for nigh on 25 years. It saddens me that people believe statistics on such a small number of samples. Professors included. It's like tossing a coin 3 times and 2 out of 3 come up heads.
I absolutely agree and was not saying that study proved anything, the page I linked to even discusses the likelyhood that their sample size was too small to really prove anything.
However re the roulette wheels that is a fact. I watched a documentary on people who were cheating the casinos and doing very well from it, it was quite normal for some roulette wheels to have a couple percent bias. Now the problem with roulette is better understood the casinos deal with it as I mentioned before. Also studies of other mechanical systems show definite biases once there are large enough sample sizes, you should not assume that just because something is mechanical that it must be without bias. Re the lottery balls if they are slipperier or heavier or slightly mishaped those differences could all easily introduce a bias.
If I saw a mechanical system that even with a small sample size was favoring some numbers, I would be betting with the bias. Long term it might turn out to be just a data trend OR there could be an actual bias.
... I believe there are some serious problems with the USEFULNESS of his PRNG hardware that I would like to bring to attention. Hopefully a resolution can be found.
Basically, one generally needs and uses a good PRNG specifically for cryptography.
You are talking about the RNG hardware (you said PRNG)? It's direct output is not ideal for cryptography as like all hardware RNGs it is "too" random and can produce a bad data set when you extract a short section of data.
... This COULD allow (A) Clone system based attacks, and (B) Forced biasing of the PRNG.
Cool, It's good to discuss potential issues.
... (A) (clone attacks) Is possible because one could tap into your power line as close as is feasibly possible with a waveform analyzing system and record the data on the line down to a relatively arbitrary level of precision. With this information, the algorithm you use to construct your pseudo-random data, and your cipher text, the time it would take an attacker to crack your code would be quite feasible. Especially if they knew the approximate time that you created your cipher text. There may be some brute forcing involved, but it would be light and forward going. (i.e. not trapdoor functions)
A valid point, although very difficult as even within my house there are things affecting the AC mains waveform shape, and you could never know the actual 5MHz timer sync within my device when it captured the data, nor the exact position on the mains waveform that was captured (the threshold trimpot adjustment inside the device). You would also not know the exact mains cycles I used, at the time it was used.
Those four points make it near impossible. However I still would NOT use the direct output of the RNG device as the crypto key! I said on my web page the device would be used to generate seeding data keys to then be used within a software PRNG. The is device is basically used for seed entropy that will later be turned into very high quality PRNG entropy.
... (B) (forced biasing) Is possible because, as Mr.RB pointed out, the exact noise on the line is determined by any devices attached to the line switching on and off at any given time. So if an attacker knows the time about that you are using your device, they could attach a sufficiently powerful load on the line and near your device as to dwarf other loads. They would also have accurate control of the devices on/off timing and duty cycle. Then... all that would need to be done is introduce an easy to pickup on signal, such as any signal that synchronizes with any part of the PRNG evenly. This could create significant and predictable bias in the output data, and thus in the cipher text.
Another great point, although I think you are wrong with this one. To force a bias over existing entropy requires "swamping" the existing entropy. This is quite possible with a diode junction noise based RNG but would be almost impossible with AC mains entropy. The AC mains entropy exists and is of a high power and low impedance, so the best you could hope would be to add or subtract some signal to that entropy, but not to replace the entropy. Remember entropy+pattern = entropy, regardless of what pattern you add to it.
Also there are again the factors of the 5MHz device sync being unknown and the comparator threshold voltage, and the time the data was extracted.
And the most important point (as I said on the web page) the main use of the device is not as a real time constantly running security device but to plug it in and generate a small set of good data, which is then used to "seed" a larger software PRNG system. For instance if you were building a PIC based encrypter and needed to make 1kbyte of good random data as its "seed table".
.
