True-Random Number Generator

Description

This design creates a random bitstream from the analog random fluctuations that are inherent in resistors. This requires a lot of gain, and typically would be sensitive to interfering signals that would overwhelm the noise and ruin the randomness of the output. This design entry is based on the circuit in my US patent 6,070,178, which has expired. This project adds a new interface to the random number generator to make it compatible with modern computers. This practical device provides anyone who needs it with access to cryptographically-secure true-random numbers. It is simple enough that many people will be able to build versions the device using a wide variety of generic components. The purpose of this contest entry is to spread knowledge of this circuit widely, in the hope that its use will make it more difficult for malicious actors to create a single point of failure in privacy and security.

Other applications of true-random numbers are gaming and engineering simulation.

Details

"Anyone who considers arithmetical methods of producing random digits is, of course, in a state of sin." - Von Neumann

This project provides an analog means to create true-random numbers from the thermal noise of resistors. The circuit is easy to measure and verify.

The recent unpleasantness in privacy rights and security from eavesdropping emphasizes the importance of secure cryptography. Hard crypto, the cypherpunks would call it. Random numbers are a necessary ingredient in the larger problem of cryptography.

This project is somewhat similar to an existing product, the TrueRNG – Hardware Random Number Generator, which used to be available as a $50 USB stick. I don't think there is really much of a market for this type of device. The benefit from this design will come from it being incorporated into other products to make them more secure. For example, IoT devices should be running HTTPS, and yet they may not have a ready source of entropy from their random number generator. These numbers are (slowly) generated by the Linux Kernel and put into a 4k buffer. Sources of entropy in Linux for these devices is mostly limited to network traffic. This is not always a great way to do this, and is not done in all cases. Here example random number generators used to seed SSL from the CyaSSL library. It has #ifdefs for the various operating systems, since they vary with the available hardware:

Not good. Sinful, actually. Not as bad as this one, though:

Some processors have built-in random number generators that might be pretty good. Who knows? They can't be verified by the application designer.

I designed this random number generator where the source of randomness is the thermal noise in a resistor:

My original prototype was hand-soldered to a 68HC11 board that had a prototyping area, using components from a local surplus store. I don't know where the board is now, but I might be able to find it and post a picture. I wrote code to send the random bits out the RS-232 port, which I connected to an HP-735 workstation. I wrote test code for verifying that the output data is random. These days, there is more code available for that purpose.

The patent was assigned to a startup, who embedded it into a crypto product. The startup dissolved and they did not pay the renewal fee. This irrevocably ended their rights to it, and the circuit can be freely copied. This will take care of the analog section of generating the numbers. For this project, I am going to have to create a new digital interface, since apparently the 68HC11 is no longer in vogue. I checked, and there are a few parts left on Digi-Key! But I have thrown out my paper copy of the Pink Book.

I got a discount offer from AutoDesk for the Standard Version of EAGLE, and paid $50 for a 1 year subscription. The offer was because I have a free account on circuits.io. I like the EAGLE XML file formats for schematic and layout, so I had wanted it anyway. I took an EAGLE class last year from Matt Berggren, and today I watched some refreshers on YouTube (part1) (part2) (part3) by Jeremy Blum. If I don't like EAGLE, I'll probably try KiCAD again. If anyone wants to help with the project and has strong feelings about which tools to use, I am open to suggestions.

I created a project github repo. The EAGLE files are there under revision control, along with any firmware and application software. The name of the repo is true-rng. The license is BSD.

When talking with people about the circuit online and at meetups, there are some common questions:

What is new about it?

I have recalculated the design, with all new the signal levels and bandwidth. I used modern surface-mount components, and created a new layout. There was no existing open version of this design to start from.

The first big change was to the power supply. I have made non-trivial changes: The old design required a positive and a negative supply, and the new design uses a single supply. Creating a low-noise design with a single supply is a challenge. The...

Files

analog_rng3.brd

Layout in Eagle 8.1.1. Copper should be finished. Next is silkscreen and documentation layers, Gerber checking, etc.

brd - 153.26 kB - 04/29/2017 at 23:24

Download

analog_rng3.sch

Schematic in EAGLE 8.1.1

sch - 267.95 kB - 04/28/2017 at 08:18

Download

noise_amplifier.xlsx

Design equations and BOM

sheet - 17.97 kB - 04/28/2017 at 08:14

Download

Project Logs

Collapse

PC board layout copper design finished
Tom Anderson • 04/29/2017 at 23:31 • 0 comments

I have uploaded the latest EAGLE file.
Learning EAGLE has been an adventure. There was one crash that kept happening and it really bothered me. I was able to get help from EAGLE support with recovery. To me, the way the backup files work was not intuitive. For some reason I don't understand, I have stopped doing whatever was causing the crashes, for the most part.
I also tried the BOM upload feature for the Findchips interface, but it did not like my Digi-Key part numbers. I was able to chat with the Findchips developers and they are interested in adding this feature. I like distributor part numbers because they solve various issues:
Here is what I told them:
"I have multiple manufacturer part numbers for each part, because I've already thought about multiple sourcing and have an Approved Manufacturer List (AML)
I like Digi-Key part numbers, because they are truly unique (MPNs are not unique! The same MPN can be used by different manufacturers for totally different products.) Manufacturer Names or IDs are not controlled keywords, unless you get into using Dunn's numbers (which I am not).
I like Digi-Key (or other distributor) part numbers because they distinguish cut tape from a whole reel of parts, or the different carriers for chips, etc.
MPNs sometimes vary with packaging, also, for example how many parts are on the reel, the width of the reel, etc.
Ideally, I would like a BOM spreadsheet .xlsx template that supports an AML and Digi-Key part numbers."
RNG Layout in progress: using EAGLE 8.1.1
Tom Anderson • 04/23/2017 at 09:28 • 0 comments

I have been learning EAGLE layout. My review so far is "Good, not bad. Could be better."
I like the interactive routing, and the MOVE command works well for moving existing routing. Not all tools are good at this. I need to learn more to do a real comparison. After using PCB layout for about 12 hours, I think I am better at it than I was after using gEDA/PCB for 12 hours. I am much better than I was with much more expensive CAD tools after 12 hours. I haven't tried KiCAD for that long, so I have no comparison for it.
There are some things that bother me about it: The polygons are painted, and not very well. This means that sharp-cornered polygons don't seem to be possible. After a while of using gEDA/PDB, I got to the point where I could make it do anything that I wanted. With EAGLE, I have to make the usual tradeoff: I can't draw exactly what I want, but what I can draw is more productive.
There has been one crash, but I lost very little work by manually renaming an auto-saved file. It did not offer to restore this file for me. The program briefly flashed an error message about some missing object as it went down during an UNDO. After launching it again, it didn't offer me an auto-saved file, and it had been 30 minutes since my last SAVE. Weird. I found the tip that the autosave files exist from Google search results. Google results are one of the best parts about EAGLE. There is a lot written about it online. EAGLE has more good advice online than the Open Source tools I have used. It also has much more online than the 100X and 1000X more expensive tools. If you are using the Guess-Google-Guess-Google... learning cycle, it works fine.
There are some delightful things about EAGLE layout. One is the icons. The downside of my 4k monitor is that many applications have tiny icons and no way to make them larger. Some applications let you scale the Icons. The EAGLE 2X icons have high resolution, and they are just the right size on my 4k display. They are crisp! This is a true retina application. Nice! This is my first PC layout design with a 4k monitor. There is no way I am going back, because 4k layout is amazing. Applications without scaling capability have fallen behind where they need to be.
In the example screenshot, there is a lot of label clutter because I have the component values turned on. It looks better with just reference designators and net names. The net names help. For this type of layout, I am not just making connections. Layout is an important part of the design, and I have to understand exactly what I am hooking up, and how. There is cross-highlighting to the schematic to help with this. Also, I have named all the nets, and now I am getting the payoff for this extra work.
The proof of the CAD tool is in the Gerber output. I won't really know what I have until I look at the design in an independent tool.
Work-in-progress design uploaded to Github
Tom Anderson • 04/20/2017 at 07:17 • 0 comments

The design spreadsheet, schematic, and layout are now at https://github.com/tomacorp/true-rng . The README has been updated with the license, which is MIT.
If anyone is interested in the analog design technique that I am using, please let me know. I think there is a lot written about how to analyze circuits, but not so much about how to design them. It would be good to hear what people want to read about. I could take many different directions with the writing.
The schematic is not too bad but the layout is really rough. I have the first cut at a placement done, and a little bit of routing. I can see that I should rip up all the routing, refine the placement, and route again.
One of the things that engineers often wonder is, "When is the design done?"
When I build a board, my intention is to make it as good as I know how. I have ordered production quantity boards on a new PC board layout first cut, and shipped them with no modifications needed. The reason for this is that when ordering boards, it is not that much more expensive to get more, as long as you don't mind waiting a few weeks for the boards. It is just too tempting to have more.
For this project, I don't intend to sell anything, although I might if there is sufficient interested. However, I have discovered that I enjoy improving designs until I can find any ways to make them better. That is when I know the design is finished: I can't find anything to improve.
This is my first EAGLE board. In my experience, the first board in a new CAD tool is disappointing. How will EAGLE work out? Checking will help. I should look at every part footprint and pinout. I intend to simulate the design. To do this, I will hook up a Spice simulator and bring in my simulation models. This design is about random noise, and Spice can calculate noise spectral density versus frequency. I can integrate the noise data across frequency to find the RMS value of the noise. There is also more to simulate such as a switched-capacitor power supply, voltage regulators, and filtering.
The design spreadsheet is an xlsx file. I wish there was a great spreadsheet application for electronic engineering! I used to use an open source spreadsheet called sc written by James Gosling. I contributed to sc back in the day. While writing this, I checked and found sc on github. If you are into code archeology, try it out!
Designing a PC Board for the RNG
Tom Anderson • 04/19/2017 at 17:50 • 0 comments

Enter constraints, derive component values, choose components, draw schematic, draw layout. Welcome to analog land!
The constraints are in Excel. To really check to make sure that everything will work, I can use a simulator. More time in the simulator increases the odds of first-pass success.
Read more »
The True-Random Number Generator schematic
Tom Anderson • 04/10/2017 at 20:04 • 0 comments

I have been learning EAGLE while drawing the schematic. I just bought a subscription using a 50% discount from being a (free) circuit.io registered user. $50 a year. Not bad, worth a try.
Here is what I have been working on from the point of view of the analog design. The reference designators correspond to the schematic in the project description.
In my next iteration (coming soon!) the values for R16 and R17 are 100k. The noise from R16 and R17 is amplified by U1A and U1D. These two amplified signals are then subtracted from each other by U1C. This subtraction operation cancels out any external interference that might be picked up by R16 and R17. After subtraction, there is another gain stage, and then a comparator to make a bitstream. For more detail, the patent explains every component, if I recall correctly.
The op amps U1A and U1D need to be low-noise in order to prevent the op amp noise from overwhelming the resistor noise. I am using the OPA4134, which I have used before. The resistors are 0.1% thin film 0805 25ppm/degC. Good resistors are important for good cancellation. They also have nearly the same noise as an ideal resistor. This is unlike thick-film resistors, which have more noise than that.
This is an instrument-grade design that is not optimized for cost. The idea is to have a well-controlled circuit that is easy to measure. The goal is to be easy to show that the source of numbers is truly random thermal noise from the resistors. If I were to make a lot of these, perhaps there will be a reduced-cost version.
I have a spreadsheet with all the component value calculations and signal levels, and I will post something about that after I clean it up. I might turn it into a Python program or something.
The changes I am working on will enable the circuit to run off of a USB supply. At some point I will provide a USB interface to send the output to a computer. I could do this with an Arduino, but I might use something else.
The power supply design is coming out a little weird, because it turns out that people don't seem to use negative supplies very much these days. Negative-voltage low-dropout voltage regulators are expensive and uncommon. I am changing the design to use all positive supplies. Analog circuits without negative supplies are much harder to understand. No wonder EEs have trouble learning analog these days! I think I have figured out a way to draw the schematic so that it looks as simple as a bipolar design, but uses all positive supplies.
This has been a good way to learn EAGLE, because I am spending a lot of time editing the schematic and learning how things work. I am quite particular about both schematics and layout. They are finished when I can't find anything more that can be done to improve them, either electrically or otherwise. The main problem with EAGLE is that I think the libraries are ugly. The file format is beautiful XML, though, so I might port a better-looking library to it. Would that be procrastination? I you don't hear from me for a while, that would be 'yes!'

View all 5 project logs

Discussions

minhle11567 wrote 12/15/2022 at 16:54

Numerology can change your perspective on life and your objectives and aims by drawing you towards a different pathway myinnerhustle. Through numerology, you can determine personality traits, the future, and facts about relationships, which collectively will change your life. In my opinion, all this greatly depends on faith because if you’re not a true believer, nothing will change.

Are you sure? yes | no

RoGeorge wrote 10/19/2017 at 13:30

What is the expected throughput of the device (as in number of random bits per second), please?

Are you sure? yes | no

Frank Buss wrote 04/30/2017 at 07:56

I like the idea with the differential amplifier and two stages to eliminate interfering signals. But why not using diodes to generate noise? The amplitude is much higher and the circuit gets simpler:

https://www.maximintegrated.com/en/app-notes/index.mvp/id/3469

Cheap boost converter ICs are available at Digikey to generate the 14 V from 5 V USB and negative voltages, too, to simplify OpAmp circuits.

BTW, what do you think of using a hash function to increase the randomness? It is possible to use SHA256 to create a pseudo random number generator, just by incrementing a counter and concatenating with a seed:

https://crypto.stackexchange.com/questions/12822/are-the-sha-family-hash-outputs-practically-random

What if you hash the output of your generator with it? This would eliminate any residual interfering signals completely, if my assumption is right, that if you have a random number generator which is not perfect, but at least non-predictable, and you post-process it with SHA256, then the output would be non-predictable AND perfectly random.

Are you sure? yes | no

Yann Guidon / YGDES wrote 04/30/2017 at 08:59

Are you sure? yes | no

Tom Anderson wrote 04/30/2017 at 22:38

Good questions! I will add them to the FAQ.

Why use a switched-capacitor boost supply instead of an ordinary PWM boost converter?

The boost converter will have an inductor that radiates a magnetic field that is difficult to shield. I want to have the lowest radiation possible. Most switchers use PWM to control the output voltage. Very small changes in power supply current can be detected by carefully demodulating the duty cycle or frequency of the PWM. This could potentially leak information about the random bits being created. The switched capacitor converter is a fixed ratio and not a PWM.

The magnetic field from a DC to DC converter circuit tends to leak into nearby oscilloscope probes. The inductance formed by the loop of the probe's ground clip tends to pick up the field.

The voltage ripple from a DC to DC converter is relatively well-controlled, and the filtering and voltage regulators should attenuate the ripple by a known amount. Although I haven't documented this yet, I have kept track of the supply ripple as part of the design process. Designing enough shielding and ripple reduction for PWMs with inductors in low-noise circuits requires a lot of design and testing. I have had good first-pass results with switched capacitor circuits in previous designs.

Why use resistors instead of diodes?

I have used diodes in sensitive analog applications and they are full of surprises! Resistors are much better behaved.

It is easy to verify that resistors are creating true thermal noise in accordance with well-known physical laws. Simple oscilloscope and volt meter measurements are all that is required. Many noisy devices such as diodes, transistors, and thick-film resistors have 1/f noise that is not flat with respect to frequency, and this noise level varies from device to device. This is one reason why the design uses precision thin-film resistors instead of the cheaper thick-film.

It is true that diodes can be more noisy. However, there is no guarantee of what the exact noise level should be, or that the noise will not have a pattern. For example, I could easily design an IC/diode that behaved exactly like another diode, except that it creates a random-looking, but really not-random, signal instead of noise. If this part was installed in the random number generator, there would not be an easy way to know that the numbers were not random.

Why not use a whitening function?

An application or random numbers might benefit from a whitening function. The purpose of the random number generator is to create a well-known amount of randomness that is based on well-characterized and understood physical processes. Entropy + SHA256 is not equivalent to more entropy, because it assumes that SHA256 is not reversible. Historically, people who design this sort of algorithm have sometimes included a secret back door that makes the function more easily reversible. Using something like SHA256 also requires the user to trust the person who developed the SHA256 code and algorithm to have done it correctly, and also to trust that the algorithm works as advertised. The purpose of the project is to create random numbers that are verifiable based on physics, not a trust relationship.

Why not just use SHA256 to create a pseudo random number generator, just by incrementing a counter and concatenating with a seed?

This approach falls under the category of "not good uses for SHA256". I first learned about challenges with random numbers when debugging problems in a Monte-Carlo circuit simulation that used a similar approach.

Are you sure? yes | no

Frank Buss wrote 04/30/2017 at 23:04

Thanks for your answers, I guess makes sense, I don't know much about analog electronics.

Let me know if I can help with the digital part, that's were I'm an expert (see for example http://www.frank-buss.de/kerberos/index.html ). I think providing a USB COM port interface would be the easiest way and the most portable for all operating systems, without the need to write extra drivers for it. Something cheap like the PIC16F1454 could do this, which has a 10 bit resolution ADC, too. The device could provide a continues stream of random bytes over the COM port emulation at some standard like 115,200 baud rate. Would be nice if I would have such a random number generator.

Are you sure? yes | no

Tom Anderson wrote 04/10/2017 at 19:40

R16 and R17 are both thermal noise sources. More explanations will be posted soon.

For me, this sort of thing is simple, and digital circuits are complex!

Are you sure? yes | no

Antti Lukats wrote 04/10/2017 at 07:43

very very complicated schematic, it uses thermal noise from which one of the resistors??

Are you sure? yes | no

True-Random Number Generator

Description

Details