Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OneRNG – Open Hardware Random Number Generator

onerng.info

Post reply on HN
Print view View original

31–40 of 89 posts

Re: OneRNG – Open Hardware Random Number Generator

#31

Post by michaelt »

Taniwha wrote: post #18
gear54rus wrote: post #9

This seems sound. However, I'm in doubt about some of their points: > You can ask it to dump the current firmware to you It can dump the firmware but it can still execute something else than this (or in addition to) this firmware, can't it? > You can see all the components on the board The fact that I can see these tiny thingies doesn't do much good either? Can I, seeing them, tell what they do? No. Building one of t…

Note: I'm Paul the designer You're completely right someone could put some other firmware on the image but have it return the correct one - we solve this by: - padding the image to the size of the ROM (256k, the runtime image is ~10k)with random data making it incompressible - signing the image (including the random bit) so that the image can't be altered On a linux system the udev install script kicks off a process…

  padding the image to the size of the ROM (256k, the runtime 
  image is ~10k)with random data making it incompressible - 
  signing the image (including the random bit) so that the 
  image can't be altered
You could pad it with data that looks random, but is secretly compressible. For example, the output of a prng with a known seed.

Why not pad it with something that's already compressed, but which has information content, like a nice jpeg or something?

Re: OneRNG – Open Hardware Random Number Generator

#33

Post by Taniwha »

gioele wrote: post #16
tribaal wrote: post #3

Well, I'm happy to see that for once, they understand that the single most important thing is that it's verifiable . So many crypto-related systems ask you to trust the provider implicitly it's not even funny. I don't care who you are, if I can't look at the source (all the way down) of your product and build it myself, it's not going to make the cut as a "secure" system. You can provide additional guarantees and pro…

> You can provide additional guarantees and proofs, but showing me the source is item number 0. And item number 0.5 is allowing me to build the source and upload it to a pristine EEPROM chip.

as part of our kickstarter we'll be offering programmers as an added reward - you can build the image from source and program your device - and we hope you do and share the results with the world

You can't program it over the USB (although we could) we consider that that would be a security problem - and given recent security issues with programmable USB devices ....

Re: OneRNG – Open Hardware Random Number Generator

#34

Post by raverbashing »

deutronium wrote: post #29
raverbashing wrote: post #28

Earlier quoted context omitted.

I doesn't matter. And being in a semiconductor it is a quantum process (in fact most sources of noise in circuits are quantum in origin - not that it matters)

That's untrue, just because it's a semiconductor, doesn't mean it can't generate data effected by non-quantum properties such as temperature.

"it can't generate data effected by non-quantum properties such as temperature"

And do you think quantum effects are not affected by temperature? REALLY?!

Start here http://ecee.colorado.edu/~bart/book/distrib.htm

Re: OneRNG – Open Hardware Random Number Generator

#36

Post by notthetup »

Taniwha wrote: post #33
gioele wrote: post #16

Earlier quoted context omitted.

> You can provide additional guarantees and proofs, but showing me the source is item number 0. And item number 0.5 is allowing me to build the source and upload it to a pristine EEPROM chip.

as part of our kickstarter we'll be offering programmers as an added reward - you can build the image from source and program your device - and we hope you do and share the results with the world You can't program it over the USB (although we could) we consider that that would be a security problem - and given recent security issues with programmable USB devices ....

One of the kickstarter rewards could be the ICSP programmer HW (i'm guessing that's what you're using) so who ever wants to program it could do it.

Re: OneRNG – Open Hardware Random Number Generator

#37

Post by notthetup »

Taniwha wrote: post #19
bensn wrote: post #15

Suggestion for modification: Call it OpenRNG instead of OneRNG. In every second sentence i read the word open. Its obviously a main purpose.

it's a sad pun, we're from NZ ....

Just for that I will support you guys when it goes on kickstarter!

Re: OneRNG – Open Hardware Random Number Generator

#38

Post by Taniwha »

michaelt wrote: post #31
Taniwha wrote: post #18

Earlier quoted context omitted.

Note: I'm Paul the designer You're completely right someone could put some other firmware on the image but have it return the correct one - we solve this by: - padding the image to the size of the ROM (256k, the runtime image is ~10k)with random data making it incompressible - signing the image (including the random bit) so that the image can't be altered On a linux system the udev install script kicks off a process…

padding the image to the size of the ROM (256k, the runtime image is ~10k)with random data making it incompressible - signing the image (including the random bit) so that the image can't be altered You could pad it with data that looks random, but is secretly compressible. For example, the output of a prng with a known seed. Why not pad it with something that's already compressed, but which has information content, l…

well you have to consider me (the designer, the guy putting the original code in the device that you want to verify and make sure that it's not someone else's code) as trustworthy. After all I'm the one who's trying to protect the integrity of my product, I'm not going to give you a compressible bitstream if I can possible help it - and I'm going to publish the bitstream I am using so you can check

Re: OneRNG – Open Hardware Random Number Generator

#39

Post by dspillett »

Taniwha wrote: post #23

Note: I'm Paul the designer Some background - this board is in late beta testing, we're going to kickstart it and release it (with papers scheduled at a couple of conferences) - it's hitting Hacker News a little early - but keep us in mind when we do finally release to the public - at the moment we haven't published the design - we'll be putting up both the firmware an hardware designs on GitHub when we think it's re…

> we're going to kickstart it and release it

Do you have any timescales for that yet, or are such decisions still heavily dependant on feedback from testing?

Re: OneRNG – Open Hardware Random Number Generator

#40

Post by DanBC »

yen223 wrote: post #22
gioele wrote: post #21

> It even has a “tinfoil hat” to prevent RF interference Isn't this a problem in the US, being against the famous part 15 of the FCC rules: «Operation is subject to the following two conditions: (1) this device may not cause harmful interference, and (2) this device must accept any interference received, including interference that may cause undesired operation.»

Huh, interesting. What's the rationale behind the 2nd condition?

You have to design devices such that they don't fail when subject to interference.

Put a mobile phone near a radio, send a text. You hear some burbling. Imagine that burbling is picked up by an insulin pump - you don't wan the pump to increase or decrease the dose based on that burble.

See also analogue mobile phones which used to affect some gas station pump billing readouts. (CertInly some CB radios used to, whih caused bans, and phones are still banned in some stations today).

Post reply on HN