The Challenges of IoT, TLS, and Random Number Generators in the Real World

 Well put piece, technical  .... introduction. 

The Challenges of IoT, TLS, and Random Number Generators in the Real World

Bad random numbers are still with us and are proliferating in modern systems.

By James P. Hughes, Whitfield Diffie

IoT (Internet of things) is now a first-class member of the Internet, communicating with cloud infrastructure. With this come additional requirements to ensure confidentiality, integrity, and authentication for every customer's data. The IETF TLS (Transport Layer Security) protocol is used for almost all Internet traffic security, but TLS is not as secure as the general public believes it to be. The current TLS protocol has been proven secure, but do IoT implementations live up to that promise? IoT does not always have the luxury of hardware RNGs (random number generators) or other features typically found on servers, laptops, or even phone processors. The history of RNGs that have not been as random as expected has led to this question.

TLS does not make things easy. It uses fragile constructions such as DSA (Digital Signature Algorithm), RSA (Rivest-Shamir-Adleman), and GCM (Galois/CounterMode), and the protocol itself fails in many ways if the random numbers are not perfectly random. NIST (National Institute of Standards and Technology) and others have created standards for building, testing, and standardizing RNGs. These standards have been implemented in open-source projects that have made these tools available to the community, but there can be issues with RNGs even when using the standardized open-source libraries. Programmers are not solely to blame.

Many in the cryptographic community scoff at the mistakes made in implementing RNGs. Many cryptographers and members of the IETF resist the call to make TLS more resilient to this class of failures. This article discusses the history, current state, and fragility of the TLS protocol, and it closes with an example of how to improve the protocol. The goal is not to suggest a solution but to start a dialog to make TLS more resilient by proving that the security of TLS without the assumption of perfect random numbers is possible.  ... ') 

Generating Good Random Numbers for Encryption

 Ultimately having good unpredictable randomness is essential for encoding and thus security.

Overloaded Memory Chips Generate Truly Random Numbers for Encryption  By New Scientist, January 13, 2022

Generating truly random numbers for cryptographic algorithms could become possible through Nisa Bostanci and colleagues at Turkey's TOBB University of Economics and Technology.

The researchers' system reduces interference between chip memory used to produce random numbers and memory used to run normal computer operations.

The system forecasts when memory will be used, and compiles an inventory of random numbers then.Once the stockpile is depleted, it requests and prioritizes new random numbers in a line with other software tasks.  In 186 experiments, the system improved normal computer operational performance by 17.9% and random number generation by 25.1%, versus previous dynamic random-access memory random number-generating models.

From New Scientist

View Full Article        

Fast Random Number Generation with Lasers

Fast Random Number Generation with Lasers

Pointer to this in Schneier:       In school one of my particular areas of interest was random number use and leverage.   We detected the fact that a number of available sources of such numbers did a poor job of generating them.   Fast was not as big an idea then as quality back then.    Why? , what are they used for now?   "  Random numbers are widely used for information security, cryptography, stochastic modeling, and quantum simulations.  "   ...