Randomness Extractors in Mobile Devices
Total Page:16
File Type:pdf, Size:1020Kb
MASARYK UNIVERSITY FACULTY}w¡¢£¤¥¦§¨ OF I !"#$%&'()+,-./012345<yA|NFORMATICS Randomness extractors in mobile devices MASTER’S THESIS Filip Jurneˇcka Brno, Spring 2010 Declaration Hereby I declare, that this paper is my original authorial work, which I have worked out by my own. All sources, references and literature used or excerpted during elaboration of this work are properly cited and listed in complete reference to the due source. Brno, May 25, 2010 Filip Jurneˇcka Advisor: RNDr. Jan Bouda, Ph.D. ii Acknowledgement I would like to thank my mother for her unyielding support and belief in me. I would also like to thank all of those who helped me to get through my studies. iii Abstract Objective of this thesis is to give an overview of the problematics of ran- domness extractors with focus on searching an extractor suitable for gen- erating random numbers for cryptographic applications in mobile devices. Selected extractors based on their suitability for given application will be implemented in mobile device on a platform chosen by student. iv Keywords Evaluation hash, extractor, JavaME, mobile, pseudorandom, randomness, shift register hash, truly random, weak source. v Contents Chapter outline . 3 1 Introduction ............................... 5 1.1 Troubles with implementations of PRNGs ........... 6 1.2 Usage of randomness ....................... 7 1.2.1 Deterministic vs randomized algorithms . 7 1.2.2 Randomness in cryptography . 10 2 Sources of randomness ........................ 13 2.1 Definitions ............................. 13 2.2 Weak random sources ...................... 15 3 Randomness extractors ........................ 20 3.1 Preliminaries ............................ 20 3.2 Definitions ............................. 23 3.3 Tradeoffs .............................. 24 3.3.1 Simulating BPP . 24 3.3.2 Lower bounds . 25 3.4 Applications of extractors .................... 25 3.5 Overview of constructions .................... 26 3.6 Extractors using hash functions . 28 4 Randomness in mobile devices .................... 30 4.1 Smart cards ............................ 30 4.2 Mobile phones ........................... 31 4.2.1 Categorization of mobile phone random sources . 31 4.2.2 Analysis of available sources . 32 4.3 Analysis of underlying platforms . 34 4.3.1 Symbian platform . 36 4.3.2 Blackberry OS . 37 4.3.3 iPhone OS . 38 4.3.4 Windows Mobile . 39 4.3.5 Embedded Linux . 40 4.3.6 Android . 40 4.4 Argumentation for chosen source and platform . 41 5 Construction and implementation . 43 1 5.1 Device requirements ....................... 43 5.2 Processing data from camera . 44 5.3 Implementation of shift register hash based extractor . 47 5.4 Implementation of Evaluation Hash based extractor . 49 6 Conclusion ................................ 52 2 Chapter outline This thesis is dealing with the problem of acquiring close to uniformly dis- tributed random data especially in mobile phones. Since these devices gain in computational power and in range of usage, it is required to introduce such data for mainly cryptographic purposes in order to protect communi- cation and these devices in general. However, manufacturers of these devices provide little to no support for third-party developers. Therefore, we decided to generate close to uni- formly distributed random data in mobile devices using a randomness ex- tractor. Although some constructions were described in several papers, we were unable to find any implementations and perhaps perform some statis- tical comparison of them. Therefore, we decided to implement two extrac- tors based on the constructions described in [BMT+06] and [BKMS09]. In the first chapter called Introduction we will shortly elaborate on the history of randomness, explain initial motivation for randomness extrac- tors, their basic meaning and alternative approach to generating random data via randomness generators. We enrich the introduction by a few ex- amples of upstart flaws in pseudo-random number generators. We try to stress out importance of randomness in computation and its most common usage. We will provide an example of a problem and its solution using a deterministic algorithm and a randomized one and discuss their effective- ness. For that purpose we also briefly introduce complexity classes of ran- domized algorithms. Second chapter Sources of randomness will be dealing with sources of randomness and especially weak ones. Together with the third chapter, this part of the thesis extends survey done by Shaltiel [Sha02]. It gives a compre- hensive discussion on history of weak sources examined for deterministic randomness extraction and enlists main applications of extractors as well as achievements in constructions. Third chapter named Randomness extractors will be discussing mathe- matical background to randomness, its measurement and bring the formal definitions of extractor as well as some related terms. Then we will clarify what we want to achieve with an extractor and present an early construc- 3 tion of randomness extractors and achievements in the area as well as their usage in practice. In the fourth chapter Randomness in mobile devices we try to categorize nowadays mobile devices (smartphones) and discuss their options regard- ing sources of randomness. This chapter is mainly build on the dissertation thesis by Jan Krhovják [Krh09]. After that we will discuss the platforms on which these devices stand and their usability for implementation of ran- domness extractors together with random data acquisition. Chapter Construction and implementation will be critical for this thesis and it will describe the process of harvesting randomness from a camera of a mobile phone and an implementation of that. Then it will describe two of our implemented extractors in detail. These are based on previous papers by advisor of this thesis Jan Bouda and intended for further use in mobile devices, since there are no freely accessible implementations of those ex- tractors on the Internet. The last chapter Conclusion will present possible future work in the area of this thesis topic and mention some open problems regarding randomness extractors. 4 Chapter 1 Introduction Randomness, although appearing in all human’ history was at first de- scribed only in connection with gambling1. First mathematical conceptions were given by Blaise Pascal, Pierre de Fermat and Christiaan Huygens. The basic slightly inaccurate thought they came with is that outcomes of ran- dom processes are equally likely. Nowadays we define randomness as a type of circumstance or event that is described by a probability distribution Since then randomness as a scientific concept has taken place in many scientific fields, mainly in physics and mathematics. Now randomness plays a crucial part in quantum mechanics, modern evolutionary synthesis, com- puter communications, gambling industries etc. Random data are necessary for all of the above, which leads to the ques- tion how to obtain them. One already well elaborated concept stands on sources of randomness and their further processing e.g. via pseudo-random number generators (PRNG). Such sources might be anything you want, like coin flips, ball in a roulette or atmospheric noise (see chapter 2). When it is not simple to get an answer from the source, pseudo-random generators are used to produce additional randomness. They take output of a source and transform the need for measurement of a physical phenomenon into algorithmic computation. Since close to uniformly distributed random numbers are difficult to get, using (pseudo-)random number generators is quite common. Another approach is to gather somewhat random sequence and transform it into closer to uniformly distributed random data. That is where randomness extractors come in. A randomness extractor is a function that takes in an arbitrary distribution and gives out almost uniformly distributed bits. 1. Gerolamo Cardano wrote a book about games of chance, Liber de ludo aleae ("On Cast- ing the Die"). Written in the 1560s, but not published until 1663, it contains the first system- atic treatment of probability, as well as a section on effective cheating methods. 5 1. INTRODUCTION 1.1 Troubles with implementations of PRNGs It is important to stress that modern PRNGs are generally very satisfactory. However, improper solutions giving us very poor outcomes are still often used. • There is famous weakness on the side of Microsoft for their imple- mentation of pseudo-random number generator for the popular web programming language PHP. See the bitmap 1.1. A bitmap is an image represented by pixel. In this case, if the random generator returned 0, the pixel is black. As you can see, output of this generator is highly correlated. Figure 1.1: PHP rand() on Microsoft Windows • A significant mistake in the PRNG implementation for the OpenSSL Federal Information Processing Standards (FIPS) Object Module v1.1.1 has been reported by Geoff Lowe [Low07]. Due to a coding error in the FIPS self-test the auto-seeding never takes place. That means that the PRNG key and seed, which were used, correspond with the last self-test. The FIPS PRNG gets additional seed data only from date-time information, so the generated random data is far more pre- dictable than they should be, especially for the first few calls (see [Wea07]). • The X9.17 PRNG does not properly recover from state compromise. That is, an attacker who compromises the X9.17 triple-DES key, K, can compromise the whole internal state of the PRNG from then on 6 1. INTRODUCTION without much additional effort as examined in [KSW+88] by Kelsey et al. There are many more, like in an early version of Netscape SSL [GW96], Sun’s MIDP Reference Implementation of SSL [SMH05] or predictable ran- dom number generator in Debian’s OpenSSL package [Bel08], which caused guessability of cryptographic materials created on such systems. As you can see, they can have critical impact in common computer usage. 1.2 Usage of randomness Randomness was first examined in the context of gambling and keeps a lot of importance in gambling industry. Basically, every game a casino offers has at least slightly higher probability of winning on the casino’s side.