true random numbers : Java Glossary

There are two kinds of random numbers, pseudo random numbers that can be rapidly generated from mathematical formulae and true random numbers, generated from some random physical process such as radioactive decay. We are discussing true random numbers here.

Creating true random numbers requires considerably more effort than pseudo-random ones. You need to build a peripheral that is a true random number source. This would be useful for creating one-time cryptography pads and also in various simulations. Here are several ways it could work:

1. BitBabbler

   They have two models:

   BitBabbler products

   BitBabbler True Random Number Generators				Last revised/verified: 2016-03-12
   Model	Port	Speed	Time to create one CD full	Price
   black	USB (Universal Serial Bus)	650Kbits	123 min
   white	USB	2.5Mbits	34 min

   The white model has four independent generators. The black, just one. They are in Australia and they want you to pay by Mastercard, Visa or bank transfer rather but not PayPal. To pay by credit card, you do not enter your card number on a website, you send them an encrypted email with the details. They support Linux, Windows and Mac.

   ---

2. Ubld.it. They have one model:

   Ubld.it products

   Ubld.it True Random Number Generator				Last revised/verified: 2014-04-04
   Model	Port	Speed	Time to create one CD full	Price
   TRUERNG	USB	393 Kbps	21 mins

   They take PayPal

   I wrote to them about software support in Java. Check the FAQ. They responded immediately and told me:

   Since the TrueRNG displays itself as a USB serial device, in Windows an inf file is needed as a driver. Once the driver is installed the TrueRNG looks like a standard serial port. So in Java, you would access it just like any other serial device (or com port) which makes it really easy to work with.

   There is some C++ source you could integrate or modify. Even when you build it, it does not create an executable. It contains a whitening algorithm.

   From there the only commands the TrueRNG takes is raising and lowering the DTR (Data Terminal Ready) signal (which is done through the serial interface). When DTR signal is present it will begin pushing data out to the port until DTR is lost. So if you need 1600 bytes of data, you would just raise DTR, keep reading the port until 1600 bytes are received and then lower DTR. There is technically no reason why you would need to raise and lower DTR, you can simply just read the port when you need data and ignore it when you don’t, but some people feel better not having the TrueRNG spew random numbers out all the time. I figured this would be a piece of cake to write my own software to grab N bytes from it. However, to my dismay, after I had bought one, I discovered the various serial and USB support projects for Java have been abandoned or are otherwise unsuitable. I cannot even test it on the command line with com3:. So what I will have to do is write a miniature serials driver to the Windows C API (Application Programming Interface), then later look to writing them for Ubuntu etc. and hook it up with some JNI (Java Native Interface) glue. It is conceptually simple, but quite a bit of fuss. I think the vendor at least should supply a C utility to capture n bytes to a file.

   Installation is trickier than you might expect. Normally you just plug a USB device in and it finds its own driver. That does not work. Failing that you right click the *.inf file and it install. That does not work either. You have to go into the device manager and click update driver. This makes it look like COM3: but there is no software include to test the device or to collect a file-full of random numbers. The inf file is provided by Ubld.it. If you look inside the TrueRNG.inf file, there is almost nothing in it, just a bit of text. The actual work of simulating a COM (Component Object Model) port is done by the Windows usbser.sys driver. There is a link on the downloads tab of the product page. Once you insert the device to the machine, windows will prompt you for the location of the inf, you point it at it and it installs the rest. We do not have any sample java code, but there is sample C++ code for Windows (also in the downloads tab).

   Ideally this information would live on EPROM on the device so you would not need a separate inf file. They can’t very well fetch it from the Internet since many PCs (Personal Computers) used for encryption are isolated from the Internet for security.

   This is the unit I chose to buy. I don’t need one for my personal purposes, but I wanted to add support in my OTP (One Time Pad) one-time-pad for dummies encryption software, which is working, but needs to be documented for distribution. This generator was cheap, fast, available by Paypal. The picture of it make it look reasonably sturdy and serious. It is. It is very light, but has solid feel.

   I would have preferred not to need an inf file to install, but the low cost offsets that. I am pretty confident I can interface it to Java. The principle of operation is duck simple. My dream is anyone who want encryption to foil the CIA (Central Intelligence Agency), the Pentagon, quantum code crackers etc. will now be able to have it. The catch is, it comes with no software at all, not even a diagnostic program to make sure it is working.

   The bottom line is there is no serial port support for windows in Java, so you are dead in the water.

   ---

3. Araneus.fi. They have one model:

   Araneus.fi products

   Araneus.fi True Random Number Generator				Last revised/verified: 2016-03-07
   Model	Port	Speed	Time to create one CD full	Price
   Araneus Alea I	USB	100 Kbps	84 mins

   I wrote to them about software support in Java. Andreas Gustafsson responded immediately and told me:

   Probably the simplest way to integrate the Alea I TRNG into a Java application is to execute the randomfile.exe program installed by the Alea I driver CD as a subprocess to write the random numbers to a temporary file or pipe.

   The driver CD also includes an ActiveX control that supports accessing the device via COM. If the Java implementation you are using has a way of accessing ActiveX controls or COM, such as the com.ms.com.ActiveXControl class, you may be able to use that to avoid the need to run an external program, but we have no first-hand experience with Java COM interfaces, so our ability to provide assistance with that approach is limited. The driver CD contains example code for COM access from other languages such as VBScript, C# and Python, but not specifically for Java.

   If you would like to review the documentation and sample code, you may download the contents of the driver CD Documentation on the use of the randomfile.exe program is included in documentation\users_guide.pdf and code examples for COM access are under windows\activex\examples\.

   ---

4. Aware electronics

   Aware products

   Aware True Random Number Generators				Last revised/verified: 2014-04-03
   Model	Port	Speed	Time to create one CD full	Price
   RM-60	Serial 9/25	2500 bps	56 hours
   RM-80	Serial 9/25	2500 bps	56 hours

   This scheme works my monitoring the timing between click of radioactive (such as the tiny piece of Americium in a smoke detector) registered by a crude Geiger counter.

   Aware sells the RM-60 model Geiger counter for  . The RM-60 produces a down-going 75-90µ pulse each time it detects a radioactive decay particle. The times between clicks follow a Poisson distribution. You could expect about 300 counts per second with that exposed bit of Americium from a smoke detector. It can connect to a 9-pin or 25-pin serial port or a 25-pin parallel port. It works by toggling the DSR (Data Set Ready) pin. RM-60 Manual. If you don’t have a serial port, you will need a serial port card or serial port headers to an unused serial port on the motherboard.

   • If you want to log radiation on Windows you would want their Aw-Radw software for . It can also generate random numbers. Aw-Radw manual.
   • If you just want to generate random numbers, all you need is the free Aw-rand.exe to use their Geiger counters to create a stream of random numbers. Manual for Aw-rand.exe.
   • They also have a DLL (Dynamic Link Library) available AWRAND.DLL to generate 32 or 64 bit random number that works with any of the RM series.

   For higher rates, you could use the HotBits system based around the Aware Electronics RM-80 for . RM-80 manual.

   ---

5. Protego.se. They have three models:

   Protego.se products

   Protego.se True Random Number Generators				Last revised/verified: 2014-04-03
   Model	Port	Speed	Time to create one CD full	Price
   SG-100	9-pin serial	73.6 Kbps	114 mins
   R-210	USB-2	64 Kbps	131 mins.
   R-230	USB-2	2096 Kbps	4 min.

   They take PayPal.

   ---

6.   Orion Random Number Generator hardware device that generates true random numbers using a pair of noisy Zener diodes. The device hooks onto your serial port. It is limited to a 9600 baud stream (960 bytes/sec). It requires a 25-pin Serial port. They ask for payment in Dutch Guilders, which no longer exist, so the site may not be operational.

   Orion

   Orion True Random Number Generators				Last revised/verified: 2016-05-26
   Model	Port	Speed	Time to create one CD full	Price
   RNG	serial	970 bytes/sec	1443 hours

   ---

7. ComScire

   They have three models:

   ComScire products

   ComScire True Random Number Generators				Last revised/verified: 2014-04-03
   Model	Port	Speed	Time to create one CD full	Price
   PCQNG	software. extracts its randomness from PC (Personal Computer)	32 Kbps	4 hours
   PU4000KU	USB-2 with card	4 Mbps (Megabits per second)	21 mins
   PQ32MU	USB-2 with card	32 Mbps	157 sec

   ---

8. Idquantique. They have 5 models:

   IDQ products

   IDQ True Random Number Generators				Last revised/verified: 2014-04-04
   Model	Port	Speed	Time to create one CD full	Price
   USB	USB	4 Mbps	21 mins.
   PCI-4	PCI (Peripheral Component Interconnect)	16 Mbps	4 min.

   They take PayPal. They make 5 variants. I have shown the range.

   ---

9. The latest generation of Intel Israel-developed Ivy Bridge CPU (Central Processing Unit) chips have an RDRAND and RDSEED machine operations that can pump out 500 million random bytes per second. These are not quite true random numbers though they considered cryptographic quality. Difference between RDRAND and RDSEED. The mechanism uses entropy to seed a traditional pseudorandom generator. I don’t know how fast the seeding process is. Some people have expressed concerns these cannot be trusted as true random numbers. AMD (Advanced Micro Devices) does not implement these instructions. I don”t have access to an Intel CPU. Perhaps someone could write a public domain generator program where you specify the file name and number of bytes you want using only RDSEED.

10. You could use System.nanoTime to measure the time between clicks from your own Geiger counter. The trick then it to convert this into uniformly distributed bytes with no bias. Crudely, you could just use the low order 8-bits. You would discard ticks that came too soon on the heels of the previous one. You can use XOR (exclusive OR) to scramble the high and low bytes of a number together to create a more random byte that depends on both high and low byte. Any bias or patterns in the generated gibberish could be exploited by the code cracker.

    There is a mathematical effect to watch out for too. There are more measurements beginning with 1 in the universe than there are that begin with 9.

11. Similar to above, but count alpha particles emitted by a thorium Coleman lantern mantle.
12. Noisy transistor, or transistor bank. This is what Turing wanted in the original Eniac.
13. Measuring some irregular biometric function.
14. The Entropy Key uses P-N semiconductor junctions reverse biased with a high enough voltage to bring them near to, but not beyond, breakdown in order to generate noise. In other words, it has a pair of devices that are wired up in such a way that as a high potential is applied across them, where electrons do not normally flow in this direction and would be blocked, the high voltage compresses the semiconductor gap sufficiently that the occasional stray electron will quantum tunnel through the P-N junction. (This is sometimes referred to as avalanche noise.)
15. It is important that any sort of hardware number generator be continuously tested to make sure the numbers it is generating are truly random, otherwise if you use them for cryptography, you might as well be sending in plain text.
16. Custom random number generator card. It contains a high frequency 8-bit circular hardware counter that just increments rapidly. Whenever a random click occurs, you metaphorically stick your finger in the wheel of fortune and sample the value of the counter. If a click comes sooner than two complete revolutions of the wheel/counter, you discard that click.
17. Use the random.org method. A radio is tuned into a frequency where nobody is broadcasting. Just hook up your stereo to the input of your sound card. The atmospheric noise picked up by the receiver is fed into a workstation through the microphone port where it is sampled by a program as an eight bit mono signal at a frequency of 8 kHz. The upper seven bits of each sample are discarded immediately and the remaining bits are gathered and turned into a stream of bits with a high content of entropy. Skew correction is performed on the bit stream, in order to insure that there is an approximately even distribution of 0s and 1s using transition mapping. Even though random.org serves random numbers, you can’t use them for cryptography, since they are not securely delivered and they are public property.
18. Use MakeKey. The modern version of MakeKey uses the nano-timer and does not need to sit in a tight loop. A Java version would just gets an event on each keystroke. A future version might be set up as a keyboard driver to just work in the background. This would allow background tasks to run full speed. Even a 100 WPM (Words Per Minute) typist can generate only about 8 bytes a second this way. I released a DOS (Disk Operating System) Pascal version as part of Encode/Encipher in the 80’s. It sat in tight loop and sampled the low order 8 bits of a counter incrementing in a tight loop each time the user hit a keystroke. It noticed repeat-key use and discarded those samples. The method pays no attention to which keys are hit, only the timing

Choosing a Hardware Generator

Make sure you consider:

1. Cost
2. Speed
3. Does it work with your OS (Operating System)?
4. Ease of Installation.
5. Does it come with the software you need?
6. Does it come with sufficient documentation that you can write your own software to drive it?
7. How helpful are the support people.

How Hardware Generators Work

Most of the generators use a noisy transistor to produce the random bits. They then pump them out a USB port. Here is how the Ubld.it TrueRng people explained you go from there:

Since the TrueRNG displays itself as a usb serial device, in windows an inf file is needed as a driver. Once the driver is installed the TrueRNG looks like a standard serial port. So in Java, you would access it just like any other serial device (or com port) which makes it really easy to work with.

From there the only commands the TrueRNG takes is raising and lowering the DTR signal (which is done through the serial interface). When DTR signal is present it will begin pushing data out to the port until DTR is lost. So if you need 1600 bytes of data, you would just raise DTR, keep reading the port until 1600 bytes are received and then lower DTR. There is technically no reason why you would need to raise and lower DTR, you can simply just read the port when you need data and ignore it when you don’t, but some people feel better not having the TrueRNG spew random numbers out all the time.

Quality

There are various bodies and tests manufacturers can submit their devices ensuring the output is truly random.

• NIST (National Institute of Standards and Technology) Special Publication 800-22
• NIST SP 800-90
• Diehard Random
• FIPS (Federal Information Processing Standard) 140-2 Annex C
• German BSI’s AIS31

hardware random number generators