WingNews logo WingNews GitHub [2]

lordmax's comments

lordmax | 4 years ago | on: “The Matrix Resurrections” is an excellent movie

"Hackers, game, and crypto developers will enjoy “Resurrections” immensely. The general audience might have a more tepid reaction, since one has to be a coder to really get all the references and insider humor."

lordmax | 5 years ago | on: Encryption Lava Lamps (2017)

Far better solution IMHO built after industry discussion of "lava wall" years ago: https://bit.ly/3naYEBP Of course, by now we got hardware rng RPi, TrueRNG, security enclave rng - largely a solved problem on most of practical systems. just setup right, seed right and use `/dev/urandom`

lordmax | 8 years ago | on: Getting randomness from an Apple device with particle physics, thermal entropy

Here is the problem: most of these stats are not what they pretend to be (unless exact circuit / spec is published). Look at low level details of building say avalanche noise source: http://holdenc.altervista.org/avalanche/ - bandwidth is mostly bound by voltage/frequency/sampling resolution - how often you can trigger entropy event and how many of them in parallel? True result for one AN circuit: 2000 bits/sec.

What a lot of these vendors do is have some physical phenomena on the chip that feeds hardware "whitener" (endless hashing) that responds without blocking to all requests. That's practically hardware version of “/dev/urandom" that is bound only by chip IO - but its completely disconnected from bandwidth of actual “true” entropy phenomena underneath. of course it is still good CSRNG, but its not “true” source. btw nice exception: TrueRNG team are pretty honest providing direct schema - hence the real entropy speed of 40kb/sec.

In short every single entry on that list should be independent inspected down to specs and schema of whitener. If they are not publishing chip spec with exact details I highly highly doubt the bandwidth of “true” entropy events are really approaching GBps - this is the speed of whitener, not of actual generator.

lordmax | 8 years ago | on: Getting randomness from an Apple device with particle physics, thermal entropy

The key property for crypto randomness here is that these high energy particle events (be that cosmic rays, background radiation, etc) are not just random, but independent from thermal noise. They are few and far between but they affect each sample somewhere. One way or another all that entropy will get hashed, and having even few bits that are contributed by independent phenomena makes final hash extremely hard to attack.

Considering all sources that contribute noise to sensors (thermal, light photons count, high energy particles, shot/RTS noise, and i'm probably missing a few), all with unique distributions and characteristics makes each sample readout very hard to predict.

lordmax | 8 years ago | on: Getting randomness from an Apple device with particle physics, thermal entropy

DJB retort on this is now stuff of crypto hall of fame: https://gist.github.com/tarcieri/6347417#file-gistfile1-txt

> --- Cryptographers are certainly not responsible for this superstitious nonsense. Think about this for a moment: whoever wrote the /dev/random manual page seems to simultaneously believe that

   (1) we can't figure out how to deterministically expand one 256-bit
       /dev/random output into an endless stream of unpredictable keys
       (this is what we need from urandom), but

   (2) we _can_ figure out how to use a single key to safely encrypt
       many messages (this is what we need from SSL, PGP, etc.).
For a cryptographer this doesn't even pass the laugh test. --- <

lordmax | 8 years ago | on: Getting randomness from an Apple device with particle physics, thermal entropy

worth mentioning (that sort of main premise of the article that gets a little bit unnoticed in all the methodology discussion): all existing HWRNG are relatively low bandwidth - because they are bound by physical process, rather then endless spinning up of /dev/urandom. They all have to wait for physics to produce each bit, and existing chips don't have that much "physics" in them.

The main novelty factor of "camera noise HRNG" is that we effectively leveraging 12M micro HRNGs in parallel - thats where that firehose of entropy is coming from.

lordmax | 8 years ago | on: Getting randomness from an Apple device with particle physics, thermal entropy

I checked on that a while back as well. As far as i can find out SE HRNG is not exposed to user at all. It used internally in quite complicated process of secure booting and unlocking iOS device (there is an interesting presentation floating around with all details of reverse engineering of that process, and amount of security designed by Apple into their own hardware-to-hardware protocols is on very respectable level of insane). I think its likely SE HRNG is included in seeding /dev/urandom on iOS, so it is one of the most secure CSPRNGs around.
page 1
more