Nondeterministic Random Bit Generator for Secure Cryptographic Operations
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current computing systems lack adequate high-quality entropy sources necessary for generating high-quality random numbers, which are critical for secure cryptographic processes, leading to security failures and inefficiencies in cryptographic operations.
Innovation Solution
A Nondeterministic Random Bit Generator (NRBG) is integrated into processors, utilizing a hardware-based entropy source and post-processing to produce standards-compliant, high-quality random numbers, incorporating a Combined Conditioner, DRBG, and NRBG module that ensures prediction resistance and security strength through entropy validation and conditioning.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a TRNG is built using a HW-based entropy source, then truly random numbers can be produced, but high quality and high performance are lacking
Solution Approach 1:
The system divides the random number generation process into two independent segments: a TRNG module for generating high-quality entropy and a PRNG module for high-speed random number production. The TRNG segment focuses solely on quality with hardware entropy sources, while the PRNG segment handles performance with software-based algorithms, resolving the contradiction between reliability and productivity.
Solution Approach 2:
An intermediary component (entropy pool or seed mechanism) is introduced between the TRNG and PRNG modules. The TRNG periodically seeds this intermediary, which then supplies entropy to the PRNG. This intermediary allows the high-quality but slow TRNG to efficiently support the high-speed PRNG without direct coupling, achieving both quality and performance.
2Productivity
If software PRNGs are used, then high performance can be achieved, but they require seeding from TRNG and lack true randomness
Solution Approach 1:
The system performs preliminary action by having the TRNG module pre-generate high-quality entropy and store it in an entropy pool or use it to seed the PRNG module in advance. This preliminary entropy preparation allows the software PRNG to operate at high speed without repeatedly accessing the slow hardware TRNG, achieving both performance and quality.
Solution Approach 2:
The system merges the strengths of both TRNG and PRNG into a hybrid architecture. The TRNG provides true randomness for seeding, while the PRNG provides high-speed generation. The combination leverages the unpredictability of hardware entropy with the efficiency of software algorithms, achieving both reliability and productivity simultaneously.
3Reliability
If hardware entropy sources are used, then true randomness can be produced, but high quality entropy sources are lacking in current computing systems
Solution Approach 1:
The system implements self-service by incorporating a dedicated hardware entropy source module that automatically generates and manages its own entropy without requiring external intervention. The module includes built-in validation logic that autonomously assesses entropy quality and adjusts operation accordingly, reducing system complexity while maintaining high quality.
Solution Approach 2:
A feedback mechanism is implemented where the entropy validation module continuously monitors the quality of entropy from the hardware source and provides feedback to the TRNG module. This closed-loop control ensures high quality entropy is maintained while the system automatically adjusts to optimize performance, reducing the need for complex external entropy management infrastructure.
Data Source
AI summary
A hardware-based digital random number generator is provided. In one embodiment, a processor includes a digital random number generator (DRNG) to condition entropy data provided by an entropy source, to generate a plurality of deterministic random bit (DRB) strings, and to generate a plurality of nondeterministic random bit (NRB) strings, and an execution unit coupled to the DRNG, in response to a first instruction to read a seed value, to retrieve one of the NRB strings from the DRNG and to store the NRB string in a destination register specified by the first instruction.