Hardware generators was: your mail

In message Sat, 18 Jun 94 19:30:35 EDT,
  Adam Shostack <adam@bwh.harvard.edu>  writes:

> Making it PC only shuts out the Mac/UNIX market for your
> devices.  There are probably lots of folks in the research/scientific
> community who use UNIX & would buy a random number dongle that hangs
> off the serial port. For $25, I'd probably get our lab to buy 3 or 4.
>
> If you put it on a PC card, you're cutting out all other
> computers from using it.

Adam's points are correct, and I thought of them before I posted the
initial message.

My thinking was that about 90% of all computers sold are Intel PCs, and
to get my manufacturing costs down, I need volume and simplicity.
So by addressing the 90% solution first, I have a larger market without
the complexity of multiple platforms.

Once I've sold thousands of Hardware random number generators, then I can
afford the design effort for other platforms, if they still exist then :-)

Pat

Pat Farrell      Grad Student                 pfarrell@cs.gmu.edu
Department of Computer Science    George Mason University, Fairfax, VA
Public key availble via finger          #include <standard.disclaimer>

You wrote:

| My thinking was that about 90% of all computers sold are Intel PCs, and
| to get my manufacturing costs down, I need volume and simplicity.
| So by addressing the 90% solution first, I have a larger market without
| the complexity of multiple platforms.
| 
| Once I've sold thousands of Hardware random number generators, then I can
| afford the design effort for other platforms, if they still exist then :-)

	Understood, but its not a matter of addressing 90% or the
other 10%, its a matter of "Is the security gain in building a card
that only hands out each number once worth cutting out 10% of the
market?"  I think that if you are worried about rouge code on your
machine, you aren't going to run on  a computer that can't protect its
memory from random browsing.  (I can still access all of a PC's memory
from normal code, can't I?)  Thus, building a PC card doesn't really
afford you a gain in security if I can use my hostile code to read
PGP's memory locations.  If you agree with that, then there is no good
reason not to build a serial port dongle, and include me in your
potential customers. :)

Adam


-- 
Adam Shostack 				       adam@bwh.harvard.edu

Politics.  From the greek "poly," meaning many, and ticks, a small,
annoying bloodsucker.

-----BEGIN PGP SIGNED MESSAGE-----

In list.cypherpunks, adam@bwh.harvard.edu writes:

>         Understood, but its not a matter of addressing 90% or the
> other 10%, its a matter of "Is the security gain in building a card
> that only hands out each number once worth cutting out 10% of the
> market?"  I think that if you are worried about rouge code on your
> machine, you aren't going to run on  a computer that can't protect its
> memory from random browsing.  (I can still access all of a PC's memory
> from normal code, can't I?)  Thus, building a PC card doesn't really
> afford you a gain in security if I can use my hostile code to read
> PGP's memory locations.  If you agree with that, then there is no good
> reason not to build a serial port dongle, and include me in your
> potential customers. :)

The card design isn't so much security as avoiding scarce real estate on
a PC (which, at somewhere over 130 million units fielded, is a not
inconsiderable market segment).  If this were a dongle device, I'd want
it on a parallel port.  Many machines don't have a spare serial port,
and transparent dongles would be harder to do there, anyway.  But
transparent parallel port dongle technology is already established.
- -- 
    Roy M. Silvernail       |  #include <stdio.h>            | PGP 2.3 public
roy@sendai.cybrspc.mn.org   |  main(){                       | key available
                            |  int x=486;                    | upon request
                            |  printf("Just my '%d.\n",x);}  | (send yours)

-----BEGIN PGP SIGNATURE-----
Version: 2.6

iQCVAwUBLgRkdhvikii9febJAQFLeAQAitqR4viAo/o/zxVzV/ixxvDZiTtO8R3u
FrxtuNWHAnxoNivuGOJ0zkyYEGOeMFuw2s8ZFKhpGdJwLn2zFl/m9C6H7WKbjaJv
gtMAjEr1QFvmhm5KUSB9aARIWHn2kvwyqCZae829y29jH9jiNxRgIxnaezbPd5gA
xNVImYKQZOo=
=Hz6T
-----END PGP SIGNATURE-----

> The card design isn't so much security as avoiding scarce real estate on
> a PC (which, at somewhere over 130 million units fielded, is a not
> inconsiderable market segment).  If this were a dongle device, I'd want
> it on a parallel port.  Many machines don't have a spare serial port,
> and transparent dongles would be harder to do there, anyway.  But
> transparent parallel port dongle technology is already established.

I agree.  I have constructed a parallel port RNG that sampled a blank
AM radio band for its source.  The data lines give plenty of power to
the device, and there are dedicated feedback lines (busy, paper_out, &c).

However, I had a very informative discussion with Eric Hughes at
CF '94 where I learned that this was the wrong way to go to get good
random numbers.  Maybe he would like to comment since I don't
believe I can do justice to his argument.

-----BEGIN PGP SIGNED MESSAGE-----

  From the keyboard of:  roy@sendai.cybrspc.mn.org (Roy M. Silvernail)

> If this were a dongle device, I'd want it on a parallel port.  Many
> machines don't have a spare serial port ...

How about a SCSI device instead.  Most UNIX boxes and Macs nowadays have
a few unused SCSI IDs.  The great majority of DOS machines with SCSI (all
those new ones with CD-ROMs, etc.) have unused SCSI IDs.  SCSI has the
advantage of being rather fast, and is a cross-platform solution.


Richard

-----BEGIN PGP SIGNATURE-----
Version: 2.3a-sterno-bait

iQCVAgUBLgSNmPobez3wRbTBAQFWzAP/aLr0VY6hyenhzek6SI8h/+WoB4WPh7qw
HRhnCGQEjzFPVPgvD6ZR6va6pnjjCzchH16I6vM3vEDZ9rbU5blLMCT9a+PzemL4
iBRjuyFhWZP30YekazX96utgLfZqg/nK2Q+WyY9IKvDgR3kvTlM+sTRJ4jggpDKC
+gSvwqOam3Y=
=oE3j
-----END PGP SIGNATURE-----

--
Loudyellnet: Richard Johnson | Sneakernet: ECNT1-6, CB 429, CU Boulder
Phonenet:    +1.303.492.0590 | Internet:   Richard.Johnson@Colorado.EDU
   RIPEM and PGP public keys available by server, finger or request
   Speaker to avalanche dragons.   Do you really think they listen?

-----BEGIN PGP SIGNED MESSAGE-----

In list.cypherpunks, quoth Richard.Johnson@Colorado.EDU (Richard Johnson):

>   From the keyboard of:  roy@sendai.cybrspc.mn.org (Roy M. Silvernail)
> 
>> If this were a dongle device, I'd want it on a parallel port.  Many
>> machines don't have a spare serial port ...
> 
> How about a SCSI device instead.  Most UNIX boxes and Macs nowadays have
> a few unused SCSI IDs.  The great majority of DOS machines with SCSI (all
> those new ones with CD-ROMs, etc.) have unused SCSI IDs.  SCSI has the
> advantage of being rather fast, and is a cross-platform solution.

Now I have machine envy... (so SCSI here yet)  But maybe a generalized
product line?  SCSI and IDE, as well as parallel dongle.  Whatever kind
of port you happen to have laying about.  And not using up slots is
really a Good Thing.  My 486 is full right now, and I use all of it, so
pulling a card isn't an option.
- -- 
Roy M. Silvernail  []  roy@sendai.cybrspc.mn.org

                          It's just this little chromium switch.......

-----BEGIN PGP SIGNATURE-----
Version: 2.6

iQCVAwUBLgTXIxvikii9febJAQHvgAQApJpVi3SqZg9QVefA4iS31tpi0mc+rj+7
7ZJCyqQBbFe0g0C5GH1nWumHfIc5UzLpti9RWsxMVNqHQ87MTcq3eQ1tvLh6cAQO
ReEj2RqappfxgRa9seQkDNrOsrb1IuxMTtDRJBBSCvuxF+vhUiECrZV087aSUdTu
GpH+AZtFrhg=
=LWo7
-----END PGP SIGNATURE-----