Re: OS-independent entropy source?

2012-01-17 Thread Peter Waltenberg
>One of the problems is for example to get a suitably random number >soon after booting an embedded device, without external activity. >A PRNG is no good here - the sampling occurs at quite predictable >time since the power was applied. Yes, that's why Andy needs to check multiple samples gathered

Re: OS-independent entropy source?

2012-01-17 Thread Stanislav Meduna
On 17.01.2012 23:55, Peter Waltenberg wrote: > I think my point is valid though - even if it is a PRNG, provided it's a > good one (and distribution will tell you that) if an attacker can't tell > exactly when you are sampling the PRNG effectively it's a usable entropy > source. One of the proble

Re: OS-independent entropy source?

2012-01-17 Thread Stanislav Meduna
On 17.01.2012 22:47, Andy Polyakov wrote: > Come on, having me preparing bootable CF card image for a gizmo I'm not > familiar with is unrealistic. Don't you have anything you can compile > 10-lines C code and some assembler to add to? Well you mentioned tests on x86 in your paper, I thought you

Re: OS-independent entropy source?

2012-01-17 Thread Peter Waltenberg
Depends on the PLL design - which we don't know. But yes, generally they are notoriously sensitive to thermal effects. I think my point is valid though - even if it is a PRNG, provided it's a good one (and distribution will tell you that) if an attacker can't tell exactly when you are sampling the

Re: OS-independent entropy source?

2012-01-17 Thread Andy Polyakov
>> The single user case, a lot less confident, yes, PLL's tend to be noisy >> devices, and may well be behaving like a real entropy source here, however >> my EE background is 20 years old, and things may have changed - plus, you >> don't really know what the source of the noise is, that'd require

Re: OS-independent entropy source?

2012-01-17 Thread Andy Polyakov
>> If you know anybody (or if there >> is anybody reading this) who can conduct such experiment, i.e. on such >> wide temperature range, on any computer (but ARM) > > Unfortunately only ARMs in a suitable form-factor here :( > > In case you have something directly bootable from a CF card on > a P

Re: OS-independent entropy source?

2012-01-17 Thread Stanislav Meduna
On 17.01.2012 21:52, Andy Polyakov wrote: >> Out of curiosity: Does the picture change if you are running the test >> hardware in a refrigerator at -20 degrees celsius and at say >> 40 degrees? ;) > > Do *you* keep your systems in fridge? If so, how do you deal with > condensate when you take the

Re: OS-independent entropy source?

2012-01-17 Thread Andy Polyakov
> Out of curiosity: Does the picture change if you are running the test > hardware in a refrigerator at -20 degrees celsius and at say > 40 degrees? ;) Do *you* keep your systems in fridge? If so, how do you deal with condensate when you take them out (or even open the door)? I mean, no, I can't o

Re: OS-independent entropy source?

2012-01-17 Thread Stanislav Meduna
On 17.01.2012 16:52, Andy Polyakov wrote: > Maybe relevant question is not how [in]predictable is PLL's reaction on > input frequency variation, but that there is one. I mean even if PLL > reaction is predictable, *when* [thermal] variation and consequent > reaction occurs is not, right? Right, i

Re: OS-independent entropy source?

2012-01-17 Thread Andy Polyakov
> In praxis the feedback loop will exhibit both deterministic > (e.g. quantization) and random (thermal) noise. For example > if the common input clock changes, feedback loops in both > PLLs go through their transfer functions until they stabilize > on the new frequency. The resulting jitter will p