Encryption: Generating true randomness with your computer - how? 1

[chrismi]

I would like to know if there exists a password generator which creates truly random passwords (in the scientific sense of the word "random&quot, and if there is a way to program a computer to create such randomness without external measuring equipment.

My understanding is that many encryption theories only work up to their highest potential if true randomness is guaranteed. Hence, as most computer random() algorithms are only pseudo-random, then any password or key generated by a such a non-random algorithm would reduce an encryption algorithm's effectiveness -- potentially down to zero.

I have read that there are few ways to create truly random strings of data -- measuring solar flares and cosmic radiation were some of the ways mentioned. One way which involves a computer is to measure the hard drive's rotation speed accurately -- supposedly the drive varies in its speed due to such interference as wind, friction, etc.

Q1) How to write a program that measures this?
Q2) Are there other ways to achieve randomness automatically?
Q3) Do any password generators exist which use truly random numbers?

Thanks.

 

[chiph]

PGP monitors your mouse movements and keyboard typing rate to generate a list of random events. Probably not perfect, but pretty good.

I recall seeing a link somewhere that talked about a $10 circuit that used the noise from a PNP transistor to generate random numbers, but it had a weakness -- it tended to pick up the 60 or 50Hz hum from all the wiring in the typical home and office, which skewed the numbers it produced. I think it was on the PGP International website (

http://wwww.pgpi.org)

Chip H.

 

[johnhoke]

Hmmm...
There have been great papers written on "computer generated randomness" and they all boiled down to..
"A computer cannot do *anything* random"

Now they *can* attempt to be very nearly random and nearly unpredictable... but from a mathmatics POV, a computer is not a random device, nor can it produce "true randomness"

Check on

http://www.counterpane.com/labs.html

for crypto/security info and links to others..

-john

 

[chrismi]

I'm not sure about what definition of "randomness" you are referring to, however, some success *has* been achieved in this area. Check out:

http://www.bell-labs.com/user/shriver/random.html

especially:

http://www.bell-labs.com/user/shriver/postscript/random-bit-generator.ps

 

[Callum]

For mid-high level randomness (on unix boxes) use an unconnected /dev/audio as input (may wish to/need to offset any skew in the distribution by (for example) compressing the output).

To improve randomness (or perhaps more importantly improve unpredictability and reduce skew) take several random streams and XOR them together.

 

[chrismi]

Thanks, Callum,

Those are both good suggestions. What do I do on a Windows box, however, and how do I achieve high-level randomness? Thanks for any input.

Chris