This week I had a chance to add a NeuG, a True Random Number Generator, to the Free Software Foundation network. The NeuG exclusively uses free software and was developed in Japan by NIIBE Yutaka. A random number generator (RNG) is a device used to generate random numbers for computers. Without getting into a philosophical argument, we humans tend to take the concept of entropy (randomness) for granted. If we wish to produce random data, we simply do so. Computers, on the other hand, do as we tell them to do. They follow a set of instructions provided by a programmer and follow each instruction precisely. So there is no way to ask a computer to give us a random number because we would have to tell the computer in advance what the number is. There are some ways around this. For example, we could use a system's current timestamp as a seed, or starting point, for producing random-seeming numbers by using an algorithm. This approach will create the illusion of entropy, but if someone else knows both the timestamp used for the seed and the algorithm used to generate the random numbers, the sequence of the random number generator can be calculated and predicted.

To solve this problem, a True Random Number Generator (TRNG) is needed. A TRNG takes samples from various sensor data. Then it either uses the collected samples as a raw source of entropy or passes the collected sensor data to a final step for conditioning. The process of conditioning is used to remove bias (trends in the samples taken from sensor readings) from the random numbers produced by the TRNG. In general, conditioning is the process of passing samples collected by the entropy source to a cryptographic hashing algorithm (a one-way mathematical function). Thus, the bias is stripped out of the output and true random numbers can be collected.

At this point, you might ask, "But why are random numbers so important in the first place?" The most common uses of a TRNG include generating cryptographic keys, input for a simulation, and games (including video games and slot machines). If you have a program that requires non-deterministic data, a TRNG can be used to provide it. Our use case at the FSF is to generate strong cryptographic keys. In the age of mass surveillance, the ability to generate strong keys is increasingly important.

Most RNGs function by taking samples from various sources of input from analog sensors. A NeuG uses four sensors for input, and reads them with a STM32F103 microcontroller. These sensors take input from the voltage reference pin on the STM32F103 (VRef), a temperature sensor (Temp), and two analog input pins on the STM32F103 (A0 and A1). These inputs are then combined into the following pairs: VRef and A0, Temp and A1, VRef and A1, and Temp and A0. Next, the sensor data is converted into a digital signal and passed four times through a cyclic redundancy check (CRC) module. Finally, the data is sent to a SHA-256 function to condition the output before it is ready for use via USB.

Overall, the NeuG is easy to set up and install on a network. The device appears as /dev/ttyACM0 and requires no extra software for use on GNU/Linux operating systems. In the coming weeks, I will use a NeuG and am very curious to see how it performs for our use cases at the FSF. Here's more information about the NeuG, including the full source code. To try one out yourself, pick up a NeuG TRNG from the FSF Shop.