Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Affordable Hardware Random Number Generators

Affordable Hardware Random Number Generators

An explanation of avrhwrng Arduino HRNG shield + NeuG device implementation on STM32 ST Dongle / presented at IPSJ IOTS2015 Symposium Work-In-Progress session 27-NOV-2015

Kenji Rikitake

November 27, 2015
Tweet

More Decks by Kenji Rikitake

Other Decks in Technology

Transcript

  1. Affordable hardware
    random number
    generators (HRNGs)
    Kenji Rikitake / IPSJ IOTS2015 1

    View full-size slide

  2. Kenji Rikitake
    Γ͖͚ͨ ͚Μ͡
    ྗ෢ ݈࣍
    27-NOV-2015
    IPSJ IOTS2015 WIP
    Chiba, Japan
    @jj1bdx
    CC-BY 4.0
    Kenji Rikitake / IPSJ IOTS2015 2

    View full-size slide

  3. Executive summary: USE HRNG NOW
    —For all host systems
    —For all smartphones
    —For all IoT systems
    —And use a trustable HRNG
    Kenji Rikitake / IPSJ IOTS2015 3

    View full-size slide

  4. Isn't HRNG expensive?
    NO
    It's already affordable!
    A JPY1500 board will make a host computer secure
    enough
    Kenji Rikitake / IPSJ IOTS2015 4

    View full-size slide

  5. Affordable?
    —Cheaper than JPY10000 per each
    —Preferably cheaper than JPY3000
    —Or even more cheaper
    —Price now: JPY1500 for each
    Kenji Rikitake / IPSJ IOTS2015 5

    View full-size slide

  6. Why HRNG?
    Mandatory for security!
    —Keys: TLS, SSH, DNSSEC, passwords
    —Load balancing with minimal bias
    —Fairness for gambling applications
    Kenji Rikitake / IPSJ IOTS2015 6

    View full-size slide

  7. Isn't /dev/urandom enough?
    NO
    (if without HRNG)
    Kenji Rikitake / IPSJ IOTS2015 7

    View full-size slide

  8. Why /dev/urandom is not enough?
    —Insufficient seeding
    —Harvestable entropy too small
    —Harvested entropy is spent by too many
    applications simultaneously
    Kenji Rikitake / IPSJ IOTS2015 8

    View full-size slide

  9. Why Intel's rdrand (or similar HRNG of other chip
    vendors) is not enough?
    —PROPRIETARY hardware
    —Possible BACKDOORS
    —Might be too SLOW (taking hundreds of system
    clocks for each call)
    Kenji Rikitake / IPSJ IOTS2015 9

    View full-size slide

  10. Why original HRNG?
    —Required for sufficient strength of seeding /dev/
    [u]random
    —Fast and more unpredictable seeding
    —Fast enough to feed all applications through
    making /dev/[u]random sufficiently random
    Kenji Rikitake / IPSJ IOTS2015 10

    View full-size slide

  11. Obtaining statistically sound result
    —Periodic measurement of output statistical
    characteristics is required
    —The same measurement for raw output is
    recommended for early failure detection
    —Whitening by cryptographic hash functions
    (SHA256, SHA512, etc) is necessary to obrain
    statistically good and sound result
    Kenji Rikitake / IPSJ IOTS2015 11

    View full-size slide

  12. "OK then show us what you've got"
    —avrhwrng
    —ST Dongle for NeuG
    Both are USB CDC-ACM devices
    —Accessible as modem/tty devices
    Kenji Rikitake / IPSJ IOTS2015 12

    View full-size slide

  13. avrhwrng
    —With 8bit AVR Arduino
    —Reverse biased diodes
    —~10kbytes/sec (raw output:
    ~80kbytes/sec)
    —DC 12V required
    —Arduino shield
    Kenji Rikitake / IPSJ IOTS2015 13

    View full-size slide

  14. avrhwrng parts
    —74HCU04 x 1
    —2N3904 x 4
    —All available in Akizuki Denshi
    ळ݄ిࢠ௨঎
    —Parts cost: ~JPY500
    Kenji Rikitake / IPSJ IOTS2015 14

    View full-size slide

  15. Kenji Rikitake / IPSJ IOTS2015 15

    View full-size slide

  16. avrhwrng amplifiers
    Kenji Rikitake / IPSJ IOTS2015 16

    View full-size slide

  17. Why two diodes?
    —Differential input for removing
    environmental common-mode
    effects
    —... Or simply two-bit
    parallelism
    —Can be extended to more bits/
    sample
    Kenji Rikitake / IPSJ IOTS2015 17

    View full-size slide

  18. NeuG
    —Yutaka Niibe's GPLv3 HRNG software for ARM
    Cortex-M3 including Flying Stone's FST-01
    —RNG for GnuK, a secure cryptographic token
    hardware usable on GnuPG and OpenSSH
    —No external power required
    —Using internal A/D converter noise as the
    randomness source
    —~80kbytes/sec (with internal whitening)
    Kenji Rikitake / IPSJ IOTS2015 18

    View full-size slide

  19. ST Dongle for NeuG
    Kenji Rikitake / IPSJ IOTS2015 19

    View full-size slide

  20. STM32 Nucleo-64
    —ST-LINK/V2-1 part:
    reconfigurable for NeuG
    —And STM32F103 target: also
    reconfigurable as a NeuG
    —JPY1500/board for TWO
    NeuGs
    Kenji Rikitake / IPSJ IOTS2015 20

    View full-size slide

  21. FreeBSD HRNG code
    —Requires a device driver to use random_harvest(9)
    and rndtest(4)
    —... so I wrote a driver and feeder for FreeBSD 10.2-
    STABLE
    —Working stably for months
    Kenji Rikitake / IPSJ IOTS2015 21

    View full-size slide

  22. On choosing hardware
    Japanese semiconductors are no longer available
    for prototyping: use (American) well-known
    semiconductors instead (e.g., 2SC1815 -> 2N3904)
    Kenji Rikitake / IPSJ IOTS2015 22

    View full-size slide

  23. For more bandwidth
    —Parallelism (bits/sample): a simple I/O with FTDI
    FT232R/245R?
    —More sampling speed: R820T SDR + rtl_entropy?
    Kenji Rikitake / IPSJ IOTS2015 23

    View full-size slide

  24. For more applications
    —Stable operation infrastructure needed for fault
    tolerance
    —Expertise on production-level cases (e.g.,
    DNSSEC, PKI key generation)
    —We need more internal information for seeding the
    system PRNG by the external devices: Windows?
    OS X? Android? iOS? Other proprietary platforms?
    Kenji Rikitake / IPSJ IOTS2015 24

    View full-size slide

  25. My codes and docs in GitHub
    —https://github.com/jj1bdx/avrhwrng
    —https://github.com/jj1bdx/freebsd-dev-trng
    —https://github.com/jj1bdx/osx-devrandom-feeder
    Kenji Rikitake / IPSJ IOTS2015 25

    View full-size slide

  26. NeuG codes and docs
    —http://git.gniibe.org/gitweb/
    —http://www.gniibe.org/memo/development/gnuk/
    rng/neug.html
    —೔ຊޠ: http://www.gniibe.org/memo/
    development/gnuk/hardware/stm32-nucleo-
    f103.html
    Kenji Rikitake / IPSJ IOTS2015 26

    View full-size slide

  27. Other projects
    —See Wikipedia entry called Comparison of
    Hardware Random Number Generators
    Kenji Rikitake / IPSJ IOTS2015 27

    View full-size slide

  28. Thanks
    Questions?
    Kenji Rikitake / IPSJ IOTS2015 28

    View full-size slide