A Design for a Physical RNG with Robust Entropy Estimators

Abstract

Abstract. We briefly address general aspects that reliable security evaluations of physical RNGs should consider. Then we discuss an efficient RNG design that is based on a pair of noisy diodes. The main contribution of this paper is the formulation and the analysis of the corresponding stochastic model which interestingly also fits to other RNG designs. We prove a theorem that provides tight lower bounds for the entropy per random bit, and we apply our results to a prototype of a particular physical RNG.

On the Security of Oscillator-Based Random Number Generators

“…a quartz clock signal). Whereas the first approach, based on flipping times, is classical [11,9,4], to our knowledge, the second approach, based on a Wiener processes, has never been considered in the field of secure random number generators. We focus on this new approach and derive several formulas to compute the security parameters of a TRNG, notably the biases and the entropy of bit-vectors, and as well as a lower bound of the entropy rate.…”

“…For simplicity, in what follows, we keep in line with previous work in the area [11,9,4] and concentrate on symmetric (in particular balanced) oscillators, for which the falling and rising transitions are equally distributed.…”

“…Previous work on provably secure TRNGs based on sampled oscillators includes the work of [11,9,4], who consider mathematical models based on the flipping times T k of the signal, that is, the times of its rising and falling edges. These models are natural to consider as they correspond to what can be experimentally observed on an oscilloscope.…”

“…These models are natural to consider as they correspond to what can be experimentally observed on an oscilloscope. Existing work [9,4,2] report that the durations X k = T k+1 − T k between the flipping times appear in many cases to be independent and identically distributed (in short i.i.d. ), as one could expect from the physical intuition of electronic noise.…”

“…), as one could expect from the physical intuition of electronic noise. This allows one to compute a safe lower bound of the entropy rate of the TRNG [9]. Yet, we found that such time-oriented models become quickly intractable when one wishes to compute more precise security parameters, such as the maximal bias on a short vector, or the probabilities of outputting certain bit patterns.…”