Slashdot Mirror
Physicists Turn 8MP Smartphone Camera Into a Quantum Random Number Generator
KentuckyFC writes: "Random numbers are the lifeblood of many cryptographic systems and demand for them will only increase in the coming years as techniques such as quantum cryptography become mainstream. But generating genuinely random numbers is a tricky business, not least because it cannot be done with a deterministic process such as a computer program. Now physicists have worked out how to use a smartphone camera to generate random numbers using quantum uncertainties. The approach is based on the fact that the emission of a photon is a quantum process that is always random. So in a given unit of time, a light emitter will produce a number of photons that varies by a random amount. Counting the number of photons gives a straightforward way of generating random numbers. The team points out that the pixels in smartphone cameras are now so sensitive that they can pick up this kind of quantum variation. And since a camera has many pixels working in parallel, a single image can generate large quantities of random digits. The team demonstrates the technique in a proof-of principle experiment using the 8-megapixel camera on a Nokia N9 smartphone while taking images of a green LED. The result is a quantum random number generator capable of producing digits at the rate of 1 megabit per second. That's more than enough for most applications and raises the prospect of credit card transactions and encrypted voice calls from an ordinary smartphone that are secured by the laws of quantum physics."
This was done many years ago with a webcam as the LavaRand/LavaRnd project (which copied the Lavalamp PRNG).
What's the universe's seed?
The approach is based on the fact that the emission of a photon is a quantum process that is always random.
Macroscopically it sure seems random, but the underlying quantum physics show that it is still a deterministic process. Just because we don't have the right instruments to easily observe it doesn't make it have magic properties.
Because he failed to give any links...
http://www.lavarnd.org/ - Was the site linked in story below, but is now dead
Sourceforge: http://sourceforge.net/project...
http://slashdot.org/story/03/0...
Oblig. Dilbert Reference
The human-sized holes get larger as the obesity rate increases. Poor encryption. =(
http://www.xkcd.com/221/
Sig ?
Bluetooth, GPS, NFC. At the very least, the cell/wifi are listening anytime you're online anyway, and with the relatively large bandwidth there should be plenty of entropy in that noise. Right?
If the article is correct and it's possible to generate a megabit/second random number stream, then that's very nice. But that stream is effectively worthless for all the applications they mentioned since the real problem is arranging for both parties to have access to the exact same random bit stream. That problem is the real one.
To my knowledge, the limitations of pseudo random number generators are not the weak point in encryption.
To my mind, the most pressing problem are caused by Moore's law (and similar effects). Whatever encryption is worthwhile now, is worthless in 5 years.
Not to mention the human sized holes in encryption caused by human limitations.
Having a true random number stream is very valuable since one of the key weaknesses in PRNGs come when you gather enough output and can guess what random numbers the algo will use next. This compromises forward secrecy. If you can use a stream of constantly random numbers, one weakness is gone entirely leaving you more time to worry about other issues (like human weakness, processing bottlenecks, etc). Also, see the issue of a PRNG with a backdoor allowing perfect guessing of the pattern hence making the encryption useless (thanks to the NSA, no less).
I can see how it will be awkward to carry a green LED around to wave in front of your smartphone to maintain the stream but more advancement may miniaturize that part to the point where it's barely noticable [/snark]
If it doesn't take too much expense, why not toss all those RNGs into the /dev/random (or more accurately /dev/urandom as that is the only device used in more recent Android versions) pool? Even if one of the sources ends up becoming periodic, there are enough "blended bits" that it won't make as much a difference.
That is almost exactly wrong. Random number generators are a great place to subvert encryption systems, because if you can get a bad one implemented as a standard, there's not always a great way to prove that there's a backdoor in them. You can throw as much Moore's Law as you want at 2048 bit encryption, but it's still gonna take you more time than you have left until the heat death of the universe to crack my encrypted drive.
The math behind strong encryption is good, unless the NSA has something we don't know about, and it's unlikely they do because the Snowden docs reveal that they have spent quite a lot of money on doing things like poisoning random number generators. According to people like Bruce Schneier, the math works; it's things like key exchange, implementation, and getting people to use it that's the problem.
After doing some mild research, I concluded that the most practical solution for a home EE hobbyist is building a circuit to utilize the shot noise of a PN junction (e.g., in an avalanche diode or a Zener diode). But this Flash thingy looks interesting, too.
Ezekiel 23:20
Well, the problem is *also* the RNG. The bigger problem is finding a RNG like this, that can be easily embedded in electronics that you lock away. A camera won't do that.
Religion is what happens when nature strikes and groupthink goes wrong.
That's what's typically done, from what I know.
Hmmmm...camera, capturing light (or image), then using that to secure something......reminds me of Johnny Mnemonic.
Just need Ice-T and it'll be complete.
Looks like we have some NSA mods here.
Every post suggesting that this won't work because the electronics will just be covertly re-designed are being modded down.
The only question is: will they be US intelligence agencies or Chinese intelligence agencies? Or have the two world powers finally merged to form the top secret Sole Power of Ex-Communists and Republicans Empire, aka S.P.E.C.T.R.E?
The question is not really whether some physical process is random, the question is whether someone could predict some of the bits, say if you immersed the camera in a light field pulsed at the ccd refresh rate. Or an electromagnetic field that saturates the A/D converters wiring. Or...
The thing is that such a design has to be fixed, and then released in the field, and then be subjected to attacks tailored to its individual design and implementation, and there really is no magic bullet. So, "Counting the number of photons gives a straightforward way of generating random numbers" : maybe, but we won't know for sure if they are really and always random until it's been attacked for a few years.
...if we reverse the polarity... yeah, this can work!
Dark Reflection
I've had a CMOS imager noise gen for 5+ years! This is not new, I'll bet I wasn't the first to relize random image noise either? I made this discovery in an attempt to remove the noise with an algorithm. Also photon emission is not the best source! Random, sure, but will pile up in patterns so... Cosmic rays and background radiation are far better, impossible -or- at best highly impractical to remove from images, hence impossible to predict. Random number gens have been perfected for some time now? No? Crypto doesn't work if someone sees the data before or after its encoded! Obviously.
Personally I found this an interesting read:
http://ieeexplore.ieee.org/xpl...
Quantum RNG based on off-the-shelf flash memory. It's not very fast (up to 10kbit/s), but it's quite simple and since you have flash memory in close to every device, it's probably a lot cheaper to do than using optical sensors.
This is interesting but to get the bits from flash
you do not have them for other things.
A camera because of the size of the array and speed is interesting as a source
of entropy in a system. Also they are not alike so it is very hard to model
a camera and generate the same result.
Part of the news here is that the crypto folk are worried that a TLA got in
bed with a five letter company and biased the built in sparkling new RNG
instruction hardware and silicon magic in ways that they like.
Add some additional entropy and mix it in then the TLAs of the world
have a more difficult path.
This is not exactly LavaRand or aquarium bubbles but the very fast
part has value.
Truth is stranger than fiction, but it is because Fiction is obliged to stick to possibilities; Truth isn't. Mark Twain.
All of those can be manipulated, including the camera.
So it's a nice idea, but not guaranteed to be random.
This is not the sig you're looking for.
> Personally I like the idea that the underlying reality of the universe is random. I find the idea that the universe is a deterministic clockwork to be depressing.
There is a third option. A butcher from 2,000 years ago could explain that bodies are mechanical systems, with ball joints, plumbing, etc. Later, psychology developed and we began to study what makes humans tick at a different level. The mechanical level if bones and blood vessels is important, of course. To understand people, you have to also look at another level, the psychological level. Mind and body, two different parts of who we are. 2,000 years ago, a guy who built things talked about a third level of humaness, what some people call the spirit. Mind, body, spirit. We don't know much about this "spirit" level yet, but there is a wealth of evidence that SOMETHING is going on, something we can't yet explain well. It's possible that the body is deterministic clockwork, while the spirit may be governed by entirely different rules. In some ways, it seems that spiritual laws like "honesty is the best policy" (the best general rule) are just as true as physical laws like "what goes up must come down". There might be a reason for that, and it might not be because of particle physics.
I had the same thought, smartphones have plenty of physical hardware interfaces and can certainly make due. AFAIK, servers are the only place where we need a lot more entropy than a standard device and where (especially on virtual machines) there is a poverty of physical signals to mix in. Even here, however, you only need to ensure that the initial seed is random, hashing will take care of the rest. FWIW, Ubuntu 14 comes with a nifty random entropy seed protocol called pollinate.
I think the authors are just going out on an a limb to try and find some practical edge to the paper. Everyone's being pushed to do that now, it's a publicity stunt that (apparently) works.
Is there anything better than clicking through Microsoft ads on Slashdot?
A 5.6V Zener-diode is half thermal noise, half quantum noise. It costs something like 5 cent. Amplification and digitization may be another $30 or so, but only for the prototype (e.g. Arduino clone).
This is a complete non-news item.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Moore's law doesn't help.
Take Bremermann's Limit. With all the computing power available on Earth right now, assuming it actually doubles every year (instead of simply new computers coming out every 18 months which have double the power) then it will still take more than a few thousand years to do the computation. If someone converts the entire earth into a computer operating at the limit, then simply using a 512-bit key with symmetric algorithms will effectively fix the issue, since the time to brute-force the keyspace (10^72 yrs) is longer than the expected lifetime of the universe.
The Landauer limit is somewhat stronger, but may not be correct. Let's assume we have a good cryptosystem that uses a 256-bit key, with no attack better than brute force. Let us also assume that the Landauer limit is correct (it very probably is) and there is a minimum energy to perform a computation. To break such a cipher with a 256-bit key takes a worst-case time of 2^256 with an average case of 2^255.
Let's assume we're running our cracking computer at the coldest temperature ever produced, 100pK. Then it would take 9.67x10-34 J per operation. Let's pretend we can try a key with only one operation, since in reality it will take a few more but we should be correct to an order of magnitude. It therefore takes 2256*9.57x10-34 J = 1.1081x1044 J to brute force the key space, or about 5.5x1043 J in the average case. The average type 1a supernova puts out about 1.5x1044 J. It's about as much energy as we could get by covering the entire earth (including the oceans) with solar panels and using it all... for 20,000,000,000,000,000,000 years. Even with exponential growth we won't hit the Landauer limit for thousands of years.
So having a better random stream and being more resistant to cryptanalysis is more important than being resistant to increased computing power. It's far easier to use a side-channel attack than to directly attack the crypto, and far easier to attack the crypto than to brute-force the key.
Not a sentence!