Re: Sources of randomness

At 9:43 PM 11/2/95, Carl Ellison wrote:
>>Date: Thu, 2 Nov 1995 00:39:29 -0800
>>From: tcmay@got.net (Timothy C. May)
>
>>Digitized video input, especially from something like a noisy channel (t.v.
>>channel, for example), is quite likely to produce a lot more entropy bits
>>per second than nearly any of us ever need. (One's PGP key could be seeded
>>in a fraction of a millisecond, for example.)
>
>My cable feed into my Mac, for example, has surprisingly little noise --
>and it's only local noise (stuff only at my house, not available to the
>eavesdropper) which counts as entropy.

I meant a t.v. channel, as in broadcast t.v., such as is easily gotten with
rabbit ears, or nothing (since the idea is to get noise, from the ether, or
from the tuner itself). A snow-filled picture has pixels which are unlikely
in the extreme to be predicted/deduced by outside attackers, who cannot
know the details of antenna orientation, microscopic variations in
geometry, LRC, tuner sensitivity, etc. That is, snowy pictures are not
guessable.

(I'm not convinced that _cable_ signals are not random enough: my cable
picture is far from perfect, and my specific cable configuration and tuner
variations are certainly contributing to variability of the image pixels.
Granted, regularities in the image that are known to attackers--this is all
in theory, of course--will serve to reduce the entropy. But there's so much
bandwidth to burn that I suspect that even cable signals are OK to use. Of
course, removing the cable input is trivial and produces a spectacularly
snowy set of images....)

--Tim May

Views here are not the views of my Internet Service Provider or Government.
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
tcmay@got.net  408-728-0152 | anonymous networks, digital pseudonyms, zero
Corralitos, CA              | knowledge, reputations, information markets,
Higher Power: 2^756839      | black markets, collapse of governments.
"National borders are just speed bumps on the information superhighway."

Timothy C. May writes:
> I meant a t.v. channel, as in broadcast t.v., such as is easily gotten with
> rabbit ears, or nothing (since the idea is to get noise, from the ether, or
> from the tuner itself). A snow-filled picture has pixels which are unlikely
> in the extreme to be predicted/deduced by outside attackers, who cannot
> know the details of antenna orientation, microscopic variations in
> geometry, LRC, tuner sensitivity, etc. That is, snowy pictures are not
> guessable.

I'm not so sure. There may be hidden patterns we don't notice. Its on
little things like this that a cryptanalyst would try to pry open a
hole in a system. I'm unwilling to predict that the patterns are
unguessable based purely on gut instinct. As Bob Morris of the NSA has
said, never underestimate the effort your advesary will go to in order
to read your traffic.

I'll stick to recommending radioactive sources for now. Quantum
mechanics is your friend, and detectors from places like Aware are
cheap.

Perry

On Fri, 3 Nov 1995, Perry E. Metzger wrote:

> I'll stick to recommending radioactive sources for now. Quantum
> mechanics is your friend, and detectors from places like Aware are
> cheap.
What prices have you got listed? Is the equipment sensitive enough to get 
lots of entropy from a normal environment or do you need artificial sources
of radioactivity? (easy, safe and cheap enough to get?)
Got any clues on random bits vs. time?

Someone said this was discussed before, I caught the thread on the 
detector being listed but not any discussion of the product itself. Could 
anyone post an approx date so I could go look it up on the archive?
Gracias.
Interesting stuff.

On Fri, 3 Nov 1995 s1113645@tesla.cc.uottawa.ca wrote:

> 
> 
> On Fri, 3 Nov 1995, Perry E. Metzger wrote:
> 
> > I'll stick to recommending radioactive sources for now. Quantum
> > mechanics is your friend, and detectors from places like Aware are
> > cheap.
> What prices have you got listed? Is the equipment sensitive enough to get 
> lots of entropy from a normal environment or do you need artificial sources
> of radioactivity? (easy, safe and cheap enough to get?)


Safe, easy-to-obtain gamma sources:  orange fiesta-ware pottery (at flea 
markets), old-style Coleman lantern mantles (not sure about the new 
ones), uranium-ore "health pillows" (Sunshine Mine, 408-225-3670).

-bd

> Got any clues on random bits vs. time?
> 
> Someone said this was discussed before, I caught the thread on the 
> detector being listed but not any discussion of the product itself. Could 
> anyone post an approx date so I could go look it up on the archive?
> Gracias.
> Interesting stuff.
>