leetronics UG (haftungsbeschränkt)
Security & Privacy
Staples

Infinite Noise TRNG

Open hardware USB true random number generator

$61,397 raised

of $200 goal

30,698% Funded! Order Below

In stock. Order now, ships within three business days.

$36

View Purchasing Options

Recent Updates

You'll be notified about news and stock updates for this project.

The Infinite Noise TRNG is an affordable and secure true random number generator (TRNG). It’s based on a modular entropy multiplier technique that continuously loops over previous random output, gathering randomness from the noise of the hardware components along the way, to generate the next random output. This way it produces a constant, measurable level of entropy which is then whitened to produce true random numbers. The openness of the implementation makes it easy to inspect and verify, as all security hardware should be!

Who needs random numbers?

Almost any cryptographic operation relies on random numbers - and there are many different approaches to collect this entropy. For Linux systems, this is mostly done with user input and other hardware timing’s "randomness". This approach is very slow and its performance mainly depends on the computer’s activity.

For situations where the Linux Random Pool /dev/random depletes and finally blocks, hardware random number generators like the Infinite Noise TRNG provide a secure, high performance way to feed entropy into your computer.

benefit from plentiful available entropy, as WPA2 authentication relies on it.

The next big thing about random number generators is security. When you take a close look at the last 20 years of information technology, there have been dozens of security incidents with flaws in random number generators.

In all these scenarios, the Infinite Noise TRNG helps you to generate random numbers with confidence. A good entropy source can’t help you with everything - but it’s fundamental for all secure applications.

Most of the points in this list of RNG related flaws can be found in the Prominent examples of the Wikipedia article "Random number generator attacks". For the rest, I’ve added some references.

Use Cases

The Infinite Noise TRNG is useful in any situation requiring more entropy than normally available on a typical personal computer. The Infinite Noise TRNG is a good choice if you are:

How It Works

The hardware derives entropy from thermal noise, like many random number generators. What divides it from other TRNGs is the *modular entropy multiplication* technique.

Thermal noise of resistors is being amplified in an infinite loop to generate data – which is not totally random yet. By using modular entropy multiplication there is some correlation of adjacent bits in the stream.

Health monitoring of important parameters of the raw datastream is implemented in the devices driver, which then uses the SHA-3 hashing function for cryptographic whitening to produce true random numbers.

There is no way to override the signal without being noticed by the driver. Of course it’s possible to influence it a bit, but because we use modular entropy multiplication, this only makes the output slightly more random.

Since by definition there are no patterns in random data, how can you know the data coming from your entropy source was not spoofed? The Infinite Noise TRNG produces this predictable level of entropy, just because it’s the only way to constantly verify the hardware is working properly. And only then will it apply whitening with the SHA3 hashing function.

It may sound daunting, but this is the key feature of this implementation, as the foreseeable (and very high) *level* of entropy enables the driver to monitor proper function of the device. This is an essential feature for any trustworthy random number generator, which most devices unfortunately are missing. Even when you can access the raw output - during operation you often don’t find a way to monitor its operation.

Hardware

The circuit implementinh modular entropy multiplication consists of a pair of a charge capacitors (C8, C9), opamps, comparators COMP1 andCOMP2, solid state switches SW1 and SW2. The driver controls these switches to run two modular entropy multipliers in parallel.

In the first half of a cycle, we need to determine if the current voltage stored in the capacitor is lower than Vref (2.5V). If thats the case, the whole charge is being multiplied by 1.84. When it is higher, we first need to subtract Vref from it – to prevent overshooting.

This logic can be solved very efficiently using the modulo operation.

In the signal loop, additional noise is collected from components along the way, which forms our random output.

Data is being sampled by readings from the two comparator outputs (tied to the capacitors) resulting in a digital stream that is returned via USB.

Channel#Connected toSignalMultiplier#
1 COMP1Digital1
3 C8Analog1
4 SWEN1Clock signal1

For more insights into modular entropy multiplication check some of the first project updates:

Software

Health Monitor

Using modular entropy multiplication a very simple but reliable entropy source like thermal noise can be used to produce a raw stream of 300.000 bit/s with a provable level of entropy of 0,86 bit per bit.

raw device output, revealing the pattern of modular entropy multiplication

Any deviations from this expected level of entropy by more than 3% are treated as "NOT OK" and the data will be discarded, so we can always be sure data seeded into the SHA3 function already was pretty random and was coming from the Infinite Noise.

Using the debug mode you can get an insight:

$ infnoise --debug --no-output 
Generated 1048576 bits.  OK to use data.  Estimated entropy per bit: 0.874112, estimated K: 1.832880
num1s:50.538887%, even misfires:0.100875%, odd misfires:0.191457%

Additionally there are some other basic sanity checks, like looking for more than 20 consecutive 1’s or 0’s.

Whitening

Data passing the health monitor will be seeded into an SHA3 hashing function (aka. Keccak-1600 sponge) to create true random numbers for your applications.

The driver allows application of a multiplier, which defines how many bits will be put out of the hashing function for each incoming bit of entropy. This enables you to generate over 50 megabyte/s of pure random numbers without measurable degradation of entropy.

The fact that you can actually apply multipliers in range of 10000+ shows how conservative the driver is with the health monitoring - and how well SHA-3 works.

Signed Packages

Signed packages for several Linux distributions are available as releases and on my website. For Debian based distros there is also an apt repository.

The driver is the most critical part of this, so make sure you verify the signatures against my PGP Key: 71AE 099B 262D C0B4 93E6 EE71 975D C25C 4E73 0A3C/0x975DC25C4E730A3C. This key is used only for code signing, so please don’t use it for contacting me.

The packages come with a unix service and udev rules to start the driver when the device is plugged in. As default application, the random numbers are passed to the linux kernels entropy pool with no multiplier. There is also a config file under /etc/infnoise.conf to permanently enable options like debug mode or multipliers.

You can always stop or disable the service when you want to access the device directly.

As it’s fully open-source, you can also compile it yourself - but you’ll need to install the service files and udev rule manually.

Anyway, you can check the GitHub revision from which the software has been compiled by using --version.

$ infnoise --version
GIT VERSION - 0.2.3
GIT COMMIT  - ad40d816ed1e2e09c6f905ce34a01287885bfa47
GIT DATE    - 2018-03-02T21:59:58+01:00
BUILD DATE  - 2018-03-02T22:07:22+01:00

In the additional package infnoise-tools, you will find some tools to process random data - for generating passwords or to analyze samples.

$ infnoise-passgen random.out 10
password:suyxi{ez{
This password has 50.00 bits of entropy

During the campaign I’ll work on the tools and driver, so make sure to sign up for updates or tell me your ideas for improvements. Please open issues on GitHub for feature requests.

How It Started

The Infinite Noise TRNG is based on a semiconductor design originally developed by Peter Allan in 1999. The design being produced through this campaign was created by Bill Cox (a.k.a., waywardgeek) and implements it with stock-components and a simple USB interface. The design was not modified by me – I just found the GitHub project and wanted to have one. I’m in touch with Bill Cox and he’s happy to support this effort.

Above was only a short summary of the basic operation principle of modular entropy multiplication. If you want to dive into all the details, please check Bill’s GitHub repository or my fork which is usually some commits ahead.

There is also a recent version from Peter Allen called the Redoubler, but I prefer Bills design as it has no firmware at all.

Device without enclosure

Features & Specifications

Comparisons

As mentioned above, the key benefit of this architecture is the continuosly verified level of entropy coming from the hardware number generator which is whitened with SHA-3 in the fully open-source driver, so it will never give out a sequence that is not totally random.

In case of an attacker trying to inject a signal, modular entropy multiplication will profit from the signal, resulting in an unsuccessful attack. Only if the injected signal is extremely strong can an attack partially succeed - as the driver will discard the data, resulting in no output at all.

open hardwareopen softwareoperating principlelive health monitorrequires firmwareoutput ratepocket-friendlyprice
Infinite Noise TRNGYes Yes modular entropy multiplication Yes no >300kbit/s - 500 Mbit/s* Yes 35 $
OneRNGYes Yes RF & avalanche noise No Yes 350 Kbit/s No 40$
ChaosKeyYes Yes reverse biased p-n junction No Yes 10 Mbit/s Yes 40$
BitBabblerNo Yes mix of 4 sources Yes unknown 0.7-1.5 Mbit/s No 40-150$
EntropyKeyNo No avalanche noise Yes yes 10 Mbit/s No 50$
RdRandNo Yes unknown No unknown >500Mbit/s Yes free
Linux CSPRNGN/AYes user-input & timing No N/Aonly very few bit/s No free

*needs lot of cpu

Test Reports

Besides the 12-hour test for every single device, there is a testsuite for extended verification of the design of this TRNG. It especially covers the different multipliers for the driver - revealing the full power of this design.

MultiplierModeSpeedEntropy per ByteFailed FIPS blocksCPU load*
0RAW 30 KiB/s 7.293417 100 % 15 %
0SHA-3 42.5 KiB/s 7.999999 0.07 % 18 %
0/dev/random 0.3 KiB/s 7.999999 0.081 % 18 %
1SHA-3 25 KiB/s 7.999999 0.078 % 19 %
1/dev/random 14 KiB/s 7.999999 0.073 % 18 %
100SHA-3 2,25 MiB/s 7.999999 0.087 % 23 %
100/dev/random 21 KiB/s 7.999999 0.095 % 25 %
10000SHA-3 77 MiB/s 7.999999 0.074 % 72 %
10000/dev/random 4.21 KiB/s 7.999999 0.086 % 85 %

*at full output rate with a Intel i7-4558U CPU @ 2.80GHz.

Each row in this table is based on a testrun generating 250 Megabytes of random data.

For more details, dieharder and rngtest check the links below.

Support & Documentation

Parts List

Mouser Part #Manufacturer Part #ReferenceQuantityDescription
863-MC74VHC1G66DFT1GMC74VHC1G66DFT1GSW1,SW22IC SWITCH SPST SC88A
511-TSV912IQ2TTSV912IQ2TAMP1IC OPAMP GP 8MHZ RRO 8DFN
757-TC75W57FKTE85LFTC75W57FKTE85LFCMP1IC COMP DUAL GP PP CMOS US8
895-FT240XQ-RFT240XQ-RUSB1IC USB FS PARALLEL FIFO 24QFN
81-GRM39X103K50JGRM188R71H103KA01JC1,C72CAP CER 10000PF 50V X7R 0603
81-GRM188F51A475ZE20GRM188F51A475ZE20DC21CAP CER 4.7UF 10V Y5V 0603
81-GRM39X104K25GRM188R71E104KA01DC3,C62CAP CER 0.1UF 25V X7R 0603
810-C1608C0G1H470JC1608C0G1H470J080AAC4,C52CAP CER 47PF 50V C0G 0603
CL10B221KB8WPNCCL10B221KB8WPNCC8,C92CAP CER 220PF 50V X7R 0603
71-CRCW0603-27-E3CRCW060327R0FKEAR1,R22RES SMD 27 OHM 1% 1/10W 0603
71-CRCW0603-10K-E3CRCW060310K0FKEAR3,R4,R5,R8,R95RES SMD 10K OHM 1% 1/10W 0603
71-CRCW0603-8.2K-E3CRCW06038K20FKEAR6,R72RES SMD 8.2K OHM 1% 1/10W 0603
81-BLM18TG601TN1DBLM18TG601TN1DL11FERRITE BEAD 600 OHM 0603 1LN
-1001-011-01101X11CONN USB A TYPE ULTRA FLAT SMD

In the Press

Smallstep Blog

"In this tutorial, we’re going to build a tiny, standalone, online Certificate Authority (CA) that will mint TLS certificates and is secured with a YubiKey."


Ask a Question

Produced by leetronics UG (haftungsbeschränkt) in Wiesbaden, Germany.

Sold and shipped by Crowd Supply.

Infinite Noise TRNG

Get one Infinite Noise TRNG with the transparent enclosure.

$36 $8 US Shipping / $18 Worldwide

About the Team

leetronics UG (haftungsbeschränkt)

Wiesbaden, Germany  ·   leetronics.de

Our mission is to make open source hardware available for the German and European market and beyond.

See Also

Subscribe to the Crowd Supply newsletter, highlighting the latest creators and projects