® THE INTEL RANDOM NUMBER GENERATOR CRYPTOGRAPHY RESEARCH, INC. WHITE PAPER PREPARED FOR INTEL CORPORATION Benjamin Jun and Paul Kocher April 22, 1999 Information in this white paper is provided without guarantee or warranty of any kind. This review represents the opinions of Cryptography Research and may or may not reflect opinions of Intel Corporation. Characteristics of the Intel RNG may vary with design or process changes. © 1999 by Cryptography Research, Inc. and Intel Corporation. 1. Introduction n = − H K∑ pi log pi , Good cryptography requires good random i=1 numbers. This paper evaluates the hardware- where pi is the probability of state i out of n based Intel Random Number Generator (RNG) possible states and K is an optional constant to for use in cryptographic applications. 1 provide units (e.g., log(2) bit). In the case of a Almost all cryptographic protocols require random number generator that produces a k-bit the generation and use of secret values that must binary result, pi is the probability that an output be unknown to attackers. For example, random will equal i, where 0 ≤ i < 2k . Thus, for a number generators are required to generate -k perfect random number generator, pi = 2 and public/private keypairs for asymmetric (public the entropy of the output is equal to k bits. This key) algorithms including RSA, DSA, and means that all possible outcomes are equally Diffie-Hellman. Keys for symmetric and hybrid (un)likely, and on average the information cryptosystems are also generated randomly. present in the output cannot be represented in a RNGs are also used to create challenges, nonces sequence shorter than k bits. In contrast, the (salts), padding bytes, and blinding values. The entropy of typical English alphabetic text is 1.5 one time pad – the only provably-secure bits per character.2 encryption system – uses as much key material as ciphertext and requires that the keystream be An RNG for cryptographic applications generated from a truly random process. should appear to computationally-bounded adversaries to be close as possible to a perfect Because security protocols rely on the RNG. For this review, we analyze whether there unpredictability of the keys they use, random is any feasible way to distinguish the Intel RNG number generators for cryptographic from a perfect RNG. applications must meet stringent requirements. The most important is that attackers, including those who know the RNG design, must not be 2. Pseudorandomness able to make any useful predictions about the RNG outputs. In particular, the apparent entropy Most “random” number sources actually of the RNG output should be as close as utilize a pseudorandom generator (PRNG). possible to the bit length. PRNGs use deterministic processes to generate a series of outputs from an initial seed state. 1 According to Shannon , the entropy H of Because the output is purely a function of the any message or state is: seed data, the actual entropy of the output can never exceed the entropy of the seed. It can, 1 Shannon, C.E., “A Mathematical Theory of 2 Menezes, Oorschot, and Vanstone, Communication,” The Bell System Technical Journal, Handbook of Applied Cryptography, vol. 27, p. 379-423, July 1948. Ch.7, CRC Press, 1997. ANALYSIS OF THE INTEL RANDOM NUMBER GENERATOR CRYPTOGRAPHY RESEARCH however, be computationally infeasible to processes, but these methods are awkward and distinguish a good PRNG from a perfect RNG. slow. For example, PGP4 version 6.02 requires that users spend about 15 seconds entering For example, a PRNG seeded with 256-bits random keystrokes or mouse movements to of entropy (or one with a 256-bit state) cannot produce a new key. Methods involving user produce more than 256 bits of true randomness. timing require inelegant user interfaces and An attacker who can guess the seed data can cannot be used (or become insecure) when predict the entire PRNG output. Guessing a 256- controlled by automated scripts. Some bit seed value is computationally infeasible, applications use hard drive seek times, but however, so it is possible that such a PRNG factors such as the drive technology, disk could be used in cryptographic applications. caches, and system timer resolution limits Examples of PRNGs designed for cryptographic require careful consideration. Measurements of applications include MD5Random and system activity, delays, configuration data, etc. SHA1Random (which respectively hold 128 bits TM,3 are also sometimes used. and 160 bits of state) in the BSAFE cryptographic toolkit. Overall, true random number generators implemented using conventional hardware tend Although properly-implemented and seeded to be slow, difficult to implement, require user PRNGs are suitable for most cryptographic involvement, and often provide unknown applications, great care must be taken in the amounts of true entropy. These methods also development, testing, and selection of PRNG make assumptions about the hardware that are algorithms. It is critical that a PRNG be properly not guaranteed. For example, operation timing seeded from a reliable source. For example, measurements may not contain the expected most PRNGs included in standard software amount of randomness under all system libraries use predictable seed or state values or configurations. Techniques that rely on user produce output that can be distinguished from events may not be reliable in unattended random data. systems such as servers. 3. The Need for TRNGs Anyone who considers Even though arithmetical methods of A true random number generator (TRNG) it is possible for producing random digits uses a non-deterministic source to produce applications to is, of course, in a state of randomness. Most operate by measuring produce their own sin. unpredictable natural processes, such as thermal secure random – John Von Neumann (1951) (resistance or shot) noise, atmospheric noise, or data, many do not. nuclear decay. The entropy, trustworthiness, and Reviews by performance all depend on the TRNG design. Cryptography Research frequently identify weaknesses in random number generation. A PRNG by itself will be insecure without a Similarly, Christopher Allen and Tim Dierks of TRNG for seeding. Seeding requires a source of Consensus Development report that “most true randomness, since it is impossible to create common problems [found in software security true randomness from within a deterministic reviews] were related to random number system. seeding.”5 Bruce Schneier writes, “Good On computers without a hardware RNG, random-number generators are hard to design, programmers typically try to obtain entropy for because their security often depends on the seed data using existing peripherals. The most common techniques involve timing user 4 PGP is available from Network Associates, Inc. 5 Dierks, T., and Allen, C., “Lessons from Doing 3 BSAFE is a software toolkit available from RSA Source Code Reviews of Commercial Products,” Data Security, Inc. Consensus Development, 1997. 2 ANALYSIS OF THE INTEL RANDOM NUMBER GENERATOR CRYPTOGRAPHY RESEARCH particulars of the hardware and software. Many products we Voltage High- Noise 6 Controlled Speed examine use bad ones.” Amplifier Oscillator Oscillator Ian Goldberg and David Wagner found that Netscape’s Johnson Thermal random number generator seed Noise Source was derived from “just three (Resistor) Super Latch quantities: the time of day, the process ID, and the parent process ID. Thus, an adversary who can Control/ FIFO Digital Corrector predict these three values can Status Reg. apply the well-known MD5 algorithm to compute the exact seed generated.”7 Although most Bus RNG flaws are not reported, Figure 1: Block diagram of the Intel RNG problems are common, partly because cryptographic software libraries often prove randomness, we have analyzed Intel’s leave it to programmers to find reliable sources design assumptions, design, and testing of seed material. procedures, as well as performed statistical tests on RNG output data. In many cases, system designers are faced with a trade-off between security and For this review, Cryptography Research convenience. For example, to avoid having to performed a series of tests and evaluated the collect fresh seed data each time the program results of experiments performed by Intel. Raw loads, many software applications store their data and design specifications for the analysis seed material on the hard drive where there can were provided by Intel. be a risk of compromise. The best sources for unpredictable data involve timing user processes, which add undesirable complexity to 4.1. Noise Source user interfaces. Johnson noise (commonly referred to as thermal noise), shot noise, and flicker noise are 4. Architecture Analysis present in all resistors. They have electrically measurable characteristics and are the result of Measuring randomness is as much a random electron and material behavior. philosophical debate as it is a mathematical The Intel RNG primarily samples thermal issue. An infinite sequence of random numbers noise by amplifying the voltage measured across will carry a known statistical distribution. It is undriven resistors. In addition to a large random impossible, however, to prove whether any component, these measurements are correlated finite set of numbers is actually random. For to local pseudorandom environmental example, the 128-bit value “0” is just as likely to characteristics8, such as electromagentic occur as hexadecimal “7c26b1b7f931eedb1f7e- radiation, temperature, and power supply e1b84764ae93”.