Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Build a tiny CA for your homelab with a Raspberry Pi

smallstep.com

Post reply on HN
Print view View original

21–30 of 56 posts

Re: Build a tiny CA for your homelab with a Raspberry Pi

#21

Post by juliangoldsmith »

myself248 wrote: post #17
ostensible wrote: post #11

This being raspberry pi absolves you from needing to buy a separate hardware noise generator: it has plenty of GPIO. For example, one can obtain entropy by sampling random noise generated by reverse-biasing a junction in a cheap pn transistor. Here is an example: http://holdenc.altervista.org/avalanche/ . Bonus — maybe it will get you hooked on electrical engineering! Btw, some versions of raspberry pi already have h…

How does the disconnected audio input of any random PC or thinclient compare? I continue to find it a bit silly to see "with a raspberry pi" when people just mean "with any random linux box that doesn't need to be very powerful". It's like listening to NPR, where every smartphone is an iPhone even if it's an Android, you know?

>How does the disconnected audio input of any random PC or thinclient compare?

That will give you RF noise, which isn't really random.

Re: Build a tiny CA for your homelab with a Raspberry Pi

#23

Post by jcims »

ostensible wrote: post #11

This being raspberry pi absolves you from needing to buy a separate hardware noise generator: it has plenty of GPIO. For example, one can obtain entropy by sampling random noise generated by reverse-biasing a junction in a cheap pn transistor. Here is an example: http://holdenc.altervista.org/avalanche/ . Bonus — maybe it will get you hooked on electrical engineering! Btw, some versions of raspberry pi already have h…

I'd do this then three years later realize that something broke and it's just been feeding zeroes for the last 18 months.

Re: Build a tiny CA for your homelab with a Raspberry Pi

#25

Post by kevindamm »

jcims wrote: post #23
ostensible wrote: post #11

This being raspberry pi absolves you from needing to buy a separate hardware noise generator: it has plenty of GPIO. For example, one can obtain entropy by sampling random noise generated by reverse-biasing a junction in a cheap pn transistor. Here is an example: http://holdenc.altervista.org/avalanche/ . Bonus — maybe it will get you hooked on electrical engineering! Btw, some versions of raspberry pi already have h…

I'd do this then three years later realize that something broke and it's just been feeding zeroes for the last 18 months.

good point, the project immediately after building the CA is to build a decent monitoring/alerting setup.

Re: Build a tiny CA for your homelab with a Raspberry Pi

#27

Post by FredPret »

jcims wrote: post #23
ostensible wrote: post #11

This being raspberry pi absolves you from needing to buy a separate hardware noise generator: it has plenty of GPIO. For example, one can obtain entropy by sampling random noise generated by reverse-biasing a junction in a cheap pn transistor. Here is an example: http://holdenc.altervista.org/avalanche/ . Bonus — maybe it will get you hooked on electrical engineering! Btw, some versions of raspberry pi already have h…

I'd do this then three years later realize that something broke and it's just been feeding zeroes for the last 18 months.

Could still have been random

https://xkcd.com/221/

https://web.archive.org/web/20011027002011/http://dilbert.co...

Re: Build a tiny CA for your homelab with a Raspberry Pi

#28

Post by evil-olive »

juliangoldsmith wrote: post #21
myself248 wrote: post #17

Earlier quoted context omitted.

How does the disconnected audio input of any random PC or thinclient compare? I continue to find it a bit silly to see "with a raspberry pi" when people just mean "with any random linux box that doesn't need to be very powerful". It's like listening to NPR, where every smartphone is an iPhone even if it's an Android, you know?

>How does the disconnected audio input of any random PC or thinclient compare? That will give you RF noise, which isn't really random.

> That will give you RF noise, which isn't really random.

what does "really" random even mean in this context? does it actually matter?

given 3 hypothetical devices in a homelab:

a) does no specialized hardware entropy collection, and instead relies entirely on the standard Linux kernel mechanisms

b) does entropy collection based on the RF noise that you're saying isn't "really" random

c) does entropy collection based on whatever mechanism you have in mind that generates "real" randomness (hand-carving bits of entropy out of quantum foam, or whatever)

even if your threat model includes "the NSA tries to break into my homelab"...device A will almost certainly be fine, they'll have ways of getting access that are much simpler than compromising the entropy pool.

I suppose device B has a theoretical vulnerability that if the NSA had physical access to your homelab, they could monitor the RF environment, and then use that to predict what its inputs to the entropy pool were. but...that's assuming they have physical access, and can plant arbitrary equipment of their own design. at that point, they don't need to care about your entropy pool, you're already compromised.

Re: Build a tiny CA for your homelab with a Raspberry Pi

#29

Post by theamk »

juliangoldsmith wrote: post #21
myself248 wrote: post #17

Earlier quoted context omitted.

How does the disconnected audio input of any random PC or thinclient compare? I continue to find it a bit silly to see "with a raspberry pi" when people just mean "with any random linux box that doesn't need to be very powerful". It's like listening to NPR, where every smartphone is an iPhone even if it's an Android, you know?

>How does the disconnected audio input of any random PC or thinclient compare? That will give you RF noise, which isn't really random.

Electrical noise (including RF noise) is really random, as in it is impossible to predict exact value.

It does have non-flat spectrum, meaning some values are more probable than others, but that only means you need to whiten it. (A rough analogy might be a 6-sided die labeled with 1,1,1,2,3,4 - yes, number 1 is much more likely to come out. No, this does not make it "not really random", and some trivial math can produce ideal random stream out of it)

The only problem with audio input is that you may end up with non-random value - like all-zero output. But properly implemented whitener should detect this and stop outputting any value at all.

Post reply on HN