Many natural phenomena generate low-level,statistically random "noise" signals, includingthermal andshot noise,jitter andmetastability of electronic circuits,Brownian motion, andatmospheric noise.[4] Researchers also used thephotoelectric effect, involving abeam splitter, otherquantum phenomena,[5][6][7][8][9] and even thenuclear decay (due to practical considerations the latter, as well as the atmospheric noise, is not viable except for fairly restricted applications or online distribution services).[4] While "classical" (non-quantum) phenomena are not truly random, an unpredictable physical system is usually acceptable as a source of randomness, so the qualifiers "true" and "physical" are used interchangeably.[10]
A hardware random number generator is expected to output near-perfect random numbers ("full entropy").[1] A physical process usually does not have this property, and a practical TRNG typically includes a few blocks:[11]
anoise source that implements the physical process producing the entropy. Usually this process isanalog, so adigitizer is used to convert the output of the analog source into a binary representation;
aconditioner (randomness extractor) that improves the quality of the random bits;
health tests. TRNGs are mostly used in cryptographical algorithms that get completely broken if the random numbers have low entropy, so the testing functionality is usually included.
Hardware random number generators generally produce only a limited number of random bits per second. In order to increase the available output data rate, they are often used to generate the "seed" for a faster PRNG. DRBG also helps with the noise source "anonymization" (whitening out the noise source identifying characteristics) andentropy extraction. With a proper DRBG algorithm selected (cryptographically secure pseudorandom number generator, CSPRNG), the combination can satisfy the requirements ofFederal Information Processing Standards andCommon Criteria standards.[12]
Hardware random number generators can be used in any application that needs randomness. However, in many scientific applications additional cost and complexity of a TRNG (when compared with pseudo random number generators) provide no meaningful benefits. TRNGs have additional drawbacks for data science and statistical applications: impossibility to re-run a series of numbers unless they are stored, reliance on an analog physical entity can obscure the failure of the source. The TRNGs therefore are primarily used in the applications where their unpredictability and the impossibility to re-run the sequence of numbers are crucial to the success of the implementation: in cryptography and gambling machines.[13]
The major use for hardware random number generators is in the field ofdata encryption, for example to create randomcryptographic keys andnonces needed to encrypt and sign data. In addition to randomness, there are at least two additional requirements imposed by the cryptographic applications:[14]
forward secrecy guarantees that the knowledge of the past output and internal state of the device should not enable the attacker to predict future data;
backward secrecy protects the "opposite direction": knowledge of the output and internal state in the future should not divulge the preceding data.
Physical devices were used to generate random numbers for thousands of years, primarily forgambling.Dice in particular have been known for more than 5000 years (found on locations in modern Iraq and Iran), and flipping a coin (thus producing a random bit) dates at least to the times ofancient Rome.[16]
The first documented use of a physical random number generator for scientific purposes was byFrancis Galton (1890).[17] He devised a way to sample aprobability distribution using a common gambling dice. In addition to the top digit, Galton also looked at the face of a dice closest to him, thus creating 6*4 = 24 outcomes (about 4.6 bits of randomness).[16]
Kendall and Babington-Smith (1938)[18] used a fast-rotating 10-sector disk that was illuminated by periodic bursts of light. The sampling was done by a human who wrote the number under the light beam onto a pad. The device was utilized to produce a 100,000-digit random number table (at the time such tables were used for statistical experiments, like PRNG nowadays).[16]
On 29 April 1947, theRAND Corporation began generating random digits with an "electronic roulette wheel", consisting of a random frequency pulse source of about 100,000 pulses per second gated once per second with a constant frequency pulse and fed into a five-bit binary counter.Douglas Aircraft built the equipment, implementing Cecil Hasting's suggestion (RAND P-113)[19] for a noise source (most likely the well known behavior of the 6D4 miniature gasthyratron tube, when placed in a magnetic field[20]). Twenty of the 32 possible counter values were mapped onto the 10 decimal digits and the other 12 counter values were discarded.[21] The results of a long run from the RAND machine, filtered and tested, were converted into a table, which originally existed only as a deck ofpunched cards, but was later published in 1955 as a book, 50 rows of 50 digits on each page[16] (A Million Random Digits with 100,000 Normal Deviates). The RAND table was a significant breakthrough in delivering random numbers because such a large and carefully prepared table had never before been available. It has been a useful source for simulations, modeling, and for deriving the arbitrary constants in cryptographic algorithms to demonstrate that the constants had not been selected maliciously ("nothing up my sleeve numbers").[22]
Since the early 1950s, research into TRNGs has been highly active, with thousands of research works published and about 2000 patents granted by 2017.[16]
Multiple different TRNG designs were proposed over time with a large variety of noise sources and digitization techniques ("harvesting"). However, practical considerations (size, power, cost, performance, robustness) dictate the following desirable traits:[23]
use of a commonly available inexpensive silicon process;
exclusive use of digital design techniques. This allows an easiersystem-on-chip integration and enables the use ofFPGAs;
compact and low-power design. This discourages use of analog components (e.g.,amplifiers);
mathematical justification of the entropy collection mechanisms.
Stipčević & Koç in 2014 classified the physical phenomena used to implement TRNG into four groups:[3]
Noise-based RNGs generally follow the same outline: the source of anoise generator is fed into acomparator. If the voltage is above threshold, the comparator output is 1, otherwise 0. The random bit value is latched using a flip-flop. Sources of noise vary and include:[24]
The drawbacks of using noise sources for an RNG design are:[25]
noise levels are hard to control, they vary with environmental changes and device-to-device;
calibration processes needed to ensure a guaranteed amount of entropy are time-consuming;
noise levels are typically low, thus the design requires power-hungry amplifiers. The sensitivity of amplifier inputs enables manipulation by an attacker;
circuitry located nearby generates a lot of non-random noise thus lowering the entropy;
a proof of randomness is near-impossible as multiple interacting physical processes are involved.[26]
The idea of chaos-based noise stems from the use of a complex system that is hard to characterize by observing its behavior over time. For example, lasers can be put into (undesirable in other applications) chaos mode with chaotically fluctuating power, with power detected using aphotodiode and sampled by a comparator. The design can be quite small, as allphotonics elements can be integrated on-chip. Stipčević & Koç characterize this technique as "most objectionable", mostly due to the fact that chaotic behavior is usually controlled by a differential equation and no new randomness is introduced, thus there is a possibility of the chaos-based TRNG producing a limited subset of possible output strings.[27]
The TRNGs based on a free-running oscillator (FRO) typically utilize one or morering oscillators (ROs), outputs of which are sampled using yet anotherclock. Sinceinverters forming the RO can be thought of as amplifiers with a very large gain, an FRO output exhibits very fast oscillations in phase and frequency domains. The FRO-based TRNGs are very popular due to their use of the standard digital logic despite issues with randomness proofs and chip-to-chip variability.[27]
Quantum random number generation technology is well established with 8 commercialquantum random number generator (QRNG) products offered before 2017.[28]
Herrero-Collantes & Garcia-Escartin list the following stochastic processes as "quantum":
nuclear decay historically was the earliest quantum method used since the 1960s owing its popularity to the availability ofGeiger counters and calibratedradiation sources. The entropy harvesting was done using an event counter that was periodically sampled or a time counter that was sampled at the time of the event. Similar designs were utilized in the 1950s to generate random noise inanalog computers. The major drawbacks wereradiation safety concerns, low bit rates, andnon-uniform distribution;[29]
shot noise, a quantum mechanical noise source found in electronic circuits, while technically a quantum effect, is hard to isolate from thethermal noise, so, with few exceptions, noise sources utilizing it are only partially quantum and are usually classified as "classical";[30]
time of arrival generators andphoton counting generators use a weak photon source, with the entropy harvested similarly to the case of radioactive decay;[32]
attenuated pulse generators are a generalization (simplifying the equipment) of the above methods that allows more than one photon in the system at a time;[33]
To reduce costs and increase robustness of quantum random number generators,[39] online services have been implemented.[28]
A plurality of quantum random number generators designs[40] are inherently untestable and thus can be manipulated by adversaries. Mannalath et al. call these designs "trusted" in a sense that they can only operate in a fully controlled, trusted environment.[41]
The failure of a TRNG can be quite complex and subtle, necessitating validation of not just the results (the output bit stream), but of the unpredictability of the entropy source.[10] Hardware random number generators should be constantly monitored for proper operation to protect against the entropy source degradation due to natural causes and deliberate attacks.FIPSPub 140-2 andNIST Special Publication 800-90B[42] define tests which can be used for this.
The minimal set of real-time tests mandated by the certification bodies is not large; for example, NIST in SP 800-90B requires just twocontinuous health tests:[43]
repetition count test checks that the sequences of identical digits are not too long, for a (typical) case of a TRNG that digitizes one bit at a time, this means not having long strings of either 0s or 1s;
adaptive proportion test verifies that any random digit does not occur too frequently in the data stream (lowbias). For bit-oriented entropy sources that means that the count of 1s and 0s in the bit stream is approximately the same.
Just as with other components of a cryptography system, a cryptographic random number generator should be designed to resistcertain attacks. Defending against these attacks is difficult without a hardware entropy source.[citation needed]
The physical processes in HRNG introduce new attack surfaces. For example, a free-running oscillator-based TRNG can be attacked using afrequency injection.[44]
There are mathematical techniques for estimating theentropy of a sequence of symbols. None are so reliable that their estimates can be fully relied upon; there are always assumptions which may be very difficult to confirm. These are useful for determining if there is enough entropy in a seed pool, for example, but they cannot, in general, distinguish between a true random source and a pseudorandom generator. This problem is avoided by the conservative use of hardware entropy sources.
^Kendall, M. G., and B. Babington-Smith. 1938. “Randomness and other random sampling numbers”. Journal of the Royal Statistical Society 101:147–166.
^Brown, George W. (January 1949),P-113, Papers, Rand Corporation,archived from the original on 2007-06-05, retrieved2009-05-10.
^Cobine, Curry (1947), "Electrical Noise Generators",Proceedings of the I.R.E. (September 1947):875–9
^Monograph report, Rand Corporation, January 2001,archived from the original on 2018-04-15, retrieved2009-01-29.
^Schneier, Bruce (1995-11-01). "Other Stream Ciphers and Real Random-Sequence Generators".Applied Cryptography (Second ed.). John Wiley & Sons, Inc. p. 423.ISBN978-0-471-11709-4.
Turan, Meltem Sönmez; Barker, Elaine; Kelsey, John; McKay, Kerry A; Baish, Mary L; Boyle, Mike (2018). NIST SP800-90B: Recommendation for the entropy sources used for random bit generation (Report). Gaithersburg, MD: National Institute of Standards and Technology.doi:10.6028/nist.sp.800-90b.
.png)