Randomness

1
Randomness
2
Why do we need random numbers?

• Unique and unpredictable secret keys
• To make some encryption schemes work, such as
  ElGamal
• For challenges in interactive protocols
• ..or more generally, to keep people honest..

3
How can we obtain a random number?

• We can get real random numbers from a truly
  random phenomenon (if such exist and can be
  measured, and measured privately)
• We can get pseudo-random numbers if we have a
  one-way function (and some initial randomness!)

4
A provably secure Pseudo Random Generator
(HILL99)
Seed
5
A practical PRG
Seed, index number
HASH
Output
6
But where do the seeds come from?

• Keyboard strokes or mouse movements perhaps not
  random, but not predictable either.
• Back-current through diodes.
• Movements in lava lamps.
• Hard drive rotation speeds.
• Many more possibilities explained here.

7
What if the numbers are not entirely random?

• In other words, what if the source is biased?
  (Such as a biased coin?)
• How do we know the quantity of randomness
  something has?

8
An unbiased coin
Probability heads 0.5 Probability tails
0.5 Entropy E-p0 log2 p0 p1 log2 p1 -0.5
2 0.5 2 1 one bit!
9
And a biased coin?

• Probability for heads 0.75
• Probability for tails 0.25
• Entropy E-0.75 log2 0.75-0.25 log2 0.25
• 0.81 almost one bit!
• Important We must not use more randomness than
  there is!

10
How do we get unbiased bits from biased
measurements?

• Heads, Heads ignore
• Heads, Tails output 0
• Tails, Heads output 1
• Tails, Tails ignore
• To avoid waste of measurements, there are other
  ways as well, see here and here.

11
Back to randomness from hard drives now!

• The rotation speed fluctuates due to turbulence
  (since the friction fluctuates).
• Turbulence is chaotic, and therefore
  unpredictable.
• We measure two identical reads (avoid cache
  hits!) and see which one is fastest.
• First fastest? output 0. Second? Output 1.

12
Reasons for latency in reads

• (A) Bus delays (not random perhaps even
  controlled by adversary!)
• (B) Turbulence
• We must know how much of the measured fluctuation
  is due to (A) and how much is due to (B) we
  only want to extract random bits from (B). (See
  paper for how.)

13
How much randomness do we get?

• Using a Sun Unltra-1 with a Seagate Cheetah disk,
  we get 5 high-quality bits, and another 572
  medium-quality bits per minute not a whole
  lot, but enough to derive a seed in twentysome
  minutes
• (Here, high-quality bits come from turbulence,
  medium-quality from bus delays, etc.)