Schneier on Security

Clive Robinson • September 25, 2021 3:01 AM

@ SpaceLifeForm, JonKnowsNothing,

And in other news,

Of ducks quacking and geese hissing,

hxtps://bc.ctvnews.ca/mobile/b-c-health-officials-release-true-hospital-numbers-after-public-pressure-1.5599428

What is the betting calling ducks geese is going on elsewhere?

Clive Robinson • September 25, 2021 6:55 AM

@ SpaceLifeForm,

Brain: Always check.

You might want to do a search on,

Sigurdur Ingi Thordarson

I’ll let your “Brain” talk you into it…

Then you could look up what some are saying about,

Marianne Ny

Yup, a mess to put it mildly, then there is the “follow the money” question,

https://www.rt.com/uk/535450-british-taxpayers-julian-assange-extradition-bill/

That 300,000 is in fact about the lowest figure you could arive at, the reality is probably ten times that, if it’s looked into properly.

Oh and this suggests you might want to add another media outlet to your “don’t link to” list,

https://antinuclear.net/2021/09/09/92998/

It’s all fun fun fun this month NOT, that you would know it, from the MSM.

Clive Robinson • September 26, 2021 3:34 AM

@ SpaceLifeForm,

The phrase,of note in the article is,

Joshua Rhodes, a research associate at the University of Texas at Austin, told E&E News. “It can have a positive emissions impact if it’s run the right way,” he said. “It can also increase emissions if it’s not.”

Whilst there is a germ of truth in that statment if you do some maths the required situation for the former is rather less than the latter.

Who is “Joshua Rhodes”

http://www.webberenergygroup.com/people/joshua-rhodes/

He has written what appears at first to be a paper that might be of interest available from that page link tilted “Are solar and wind really killing coal, nuclear and grid reliability?”

http://www.webberenergygroup.com/publications/solar-wind-really-killing-coal-nuclear-grid-reliability/

Well it’s not actually a “paper” it is an article for the “The Conversation” back in 2017,

https://theconversation.com/are-solar-and-wind-really-killing-coal-nuclear-and-grid-reliability-76741

And although it appears to have political overtones from the last sentance of the abstract,

“As energy scholars based in Texas – the national leader in wind – we’ve seen these dynamics play out over the past decade, including when Perry was governor.”

They are not realy there.

What is more important is to use the article as a basis as to what went badly wrong in Texes. Their market speeded up mainly due to cheap gas the prices dropped. Whilst some blaimed renewables such as Solar, Water, and Wind, it was actually they that saved Texes from it’s “overly efficieny” supply chain that had no “spare capacity”, something nature keeps telling us in every direction we look is important.

Clive Robinson • September 27, 2021 7:18 AM

@ SpaceLifeForm,

Petrol problems in UK

Lack of fuel or lack of delivery drivers?

Well it depends on who you ask, but the actual problem is “significant supply chain” failures due almost entirely to the moronic approach to “Brexit”.

The incumbent political party however are claiming it’s some form of satanic plot to bring down the blow job by unions or some such nonsense.

If you want to point a finger at a person or two then you could start with,

1, Theresa May (Ex PM and former Home Office Minister).
2, Pretti Patel (Home office Minister and pure racist poison).

In essence, the number of Heavy Goods (HG) Drivers of UK passport holding has dropped very steadily for the past 30years or so. They got replaced by people from the far East of Europe as their nations became members of the EU (if not long before by fraudulant paper work).

The result the “cost of living differential” drove UK HGV drivers into other occupations which are way better for their health.

Now of course we have the party of “No foreign scum” who despite what was obviously going to happen “drove the bus over the White Cliffs”.

So major major shortage of HGV drivers. Apparently the politicians solution, call out the millitary and writing to those who held HGV drivers licences to persuade them to go back into a dead end job on very low wages in a time when the UK could be heading into consumer hyper-inflation… The price of food has already gone up 100-300% even on basic food stuffs.

Well as you can imagin the shortage of HGV Drivers has caused other supply chain issues especially with things that have to cross borders. Such as the 200 medications on the UN-WHO essentials lists and just about everything else the health service needs. Including those little tubes for taking blood… I was at the hospital for half a dozen different blood tests. Well rather than use the normal number of bottles they squeased it down to just two… As for patching the hole, normally as I’m a “right little bleeder” on “rat poison” they put a sensible pad of gauze and about a foot of medical “micropore tape”… This morning it was rationed, just one half square of gause folded up quite small and just a two inch length of tape… When I asked I was told that I was lucky because of the rat poison, others were not getting anything than a dab of cotton wool about the size of a pea, that they had to hold on the hole to stop bleeding…

Oh there is a story already circulating that the politicians are considering “protected status” for “National Security” such that past HGV drivers can be forcefully conscripted, if they do not respond to the letters being sent out.

It would not be the first time this political party had pulled this sort of stunt as many in the security agencies either remember all to well or have been told.

Clive Robinson • September 27, 2021 6:48 PM

@ SpaceLifeForm, ALL,

Some C-suite folk are learning ECON-101

But not all…

It would appear that Amazon are trying it on in the UK.

From what I’ve heard Amazon are desperately short of warehouse staff, many of whom left because the big boss and those below appear to be suffering from that special type of idiocy that some call moronic.

Put simply the Amazon corporate attitude to COVID and warehouse staff was probably bordering on insane. So when “UK Benifits” were effectively the same, why take the “health risk”?

Well now the UK Gov, wants to cut benifits by the equivalent of $30/week Amazon have now started advertising on major radio networks to get staff and promising good pay rates…

Only it appears Amazon will not be even close to honest what those pay rates or working conditions will be like, or more importantly what dirty “claw back” tricks Amazon Corporate will implement to get wages down below the UK legal basic “minimum wage”. Which was not even close to a living wage prior to Brexit and COVID, both of which have in effect caused major almost hyper inflation on basic things like food, cleaning materials etc.

Even without COVID these “close in” “supply chain” issues were predicted long prior to the Brexit vote. Where it was indicated that the Eastern EU “cheap labour” would be “kicked out” thus “getting the idiot vote” thinking they could blackmail better wages etc out of employers. All that has realy happened is that businesses have gone bankrupt, because there realy are way way to few people to fill all those supply chain jobs. The catch 22 is that the employers can not pay more because they can not put prices up because people don’t have the money to buy. So a reverse ratchet is in operation and the UK consumer economy is close to being put on “major life support”. Some shops have even gone to the extent of only stocking “high profit” items on what are in effect “essentials” like bread…

Oh and guess what, I’m fully expecting more companies to “go bankrupt” due to “energy prices”. Whilst we may have sufficient “petrol” but in the wrong places, we realy don’t have sufficient “natural gas” which as it’s the major base fuel for both heating and electricity production, is going to cause very very significant problems. From the news, several consumer “energy suppliers” have already gone bankrupt, with more to follow. For political reasons the UK Government are probably going to cap domestic prices, which means commercial prices will be used to take up the income slack, which will just get passed to the ordinary citizen through much higher food and other prices that are not regulated.

But what of the net effect, of food and fuel poverty that is rapidly rising? At the very least many people are going to be way way more susceptible to respiritory disease. So if not SARS, then Flu or other pathogen with a marked level of infirmaty / lethality and reduced life expectancy…

Clive Robinson • September 29, 2021 4:31 AM

@ MarkH,

While I’m rather baffled by the meaning of a “very weak assumption,”

It means that the tests, only cover a very very small fraction of possible tests.

Therefore using the tests is seen as the “low water mark” or very least of testing you should do. Because if you fail them or get close to failing them then your generator is decidedly broken[1].

Also there are things the NIST tests do not show or can be cheated. If you take to smaller sample or to short a time span then they can only test what happens in the “window” and only detect some anomalies above a certain threshold.

I’ve already explained repeatedly what you need to be looking at and why, for some reason you want to push the dialog in some direction of your chosing to try and point score, and like others I’m getting tired of it.

My original points to Freezing_in_Brazil’s question still stand. The points I suggest you carefully consider you ignore.

So at this point I’m going to disengage from your “rabbit hole” journey, as any sensible person would have done long ago with the first early signs. Especially as this is not the first, the second, etc time you have behaved in this way…

[1] I’ve explained this before on this blog, it turns out that many ring oscillator and roulette wheel combination systems have very badly failed the NIST tests or their predecessors in the past. The IC manufacturers solution has a common path. Firstly they don’t let you the customer have access to the raw source output so you can test it yourself, take this lack of test access as a warning to avoid any TRNG. Secondly they add more ring oscilators, thinking this will improve things it usually makes little difference as they are chaotic oscillators, and even though they up the complexity of the product they have power supply etc in common thus tend to injection lock. Thirdly the manufacturers put some crypto function on the output in a chain mode as this then gets it past the NIST tests…

Clive Robinson • October 1, 2021 2:09 AM

@ JonKnowsNothing,

Best enjoy the popcorn ’cause there’s not much turkey for the holidays.

Yeh and the crops are “rotting in the fields” brcause there is nobody to pick them…

Not due to viral issues, just political stupidity ones…

I guess you could say it’s yet another demonstration of “supply chain” issues.

Oh and this will amuse, apparently yes we have farm equipment not working in the UK because some people have stolen the fuel out of it… So even automated crop gathering equipment is not working…

@ Bruce,

It’s funny how one “lack of labour created” supply chain issue actually causes another supply chain issue, because the “crooks” see an orportunity for very short term profit…

@ ALL,

In the past in the UK when there have been “shortages” in autumn and early winter, people have had their homes broken into and had their festive decorations and presents under the tree stolen…

Clive Robinson • October 1, 2021 3:20 AM

@ SpaceLifeForm,

Not Spotify, but Shopify

Ahh a shopping channel, that I would certainly miss[1]. As for AWS, well who knows what that money pit gets upto. There is not a pole long enough[2] for me to get within a country mile of them.

So all in all it went fairly quietly “this time”…

Which leaves me thinking about “epochs” are we not due the *nix 32bit time overflow[3] in mid Jan 2038?

It leaves me wondering just how many other “mini Y2K events” are going to happen before then…

[1] Miss as in “not see it” rather than “be bereft” over it not being available. The english language is so delightfully imperfect, it can mean almost anything you want it to mean… no wonder lawyers get rich.

[2] Most people don’t know where the expression “would not touch it with a barge pole” comes from. There are two parts behind it, the first is to do with very recently dead creatures, the second to the largest pole you’ve likely to have seen. When infected creatures are very sick or die, they frequently have lots of live fleas etc still on them looking for a new warm blooded home to jump to… If you get within two meters (~6ft) of such a creature you are likely to become the new home untill you become infected, sick and die. So it became the practice to use a long walking staff or similar pole at arms length to push the creature into a fire or pit etc to dispose of it. The longest poles people made and used normally were the poles used for “punting” or “polling” and similar to move boats by pushing down and away on the river bottom. At upto 5.5m (~18ft) these were three times longer than ordinary walking staffs etc. So to say you would not touch it with a barge pole implied it was something you really really would not go anywhere near at all by choice.

[3] https://www.epoch101.com

Clive Robinson • October 2, 2021 6:16 AM

@ FA,

No, those things were just not what was being debated.

Again you get it wrong.

I said to Freezing_in_Brazil that the output of a radio isotope source is biased (which is a fact). I further went on to say that the output of a TRNG would be biased from it unless the designers took care (also a fact).

Now if you dispute those facts, come up with your evidence, so far you’ve come up with nothing. Worse I’ve given you pointers so you can work it out, yet you are still either missing them, or for some reason wilfully chosing to not follow them.

So another pointer,

“What is the most quoted, yet probably least understood science based equation?”

Why would it relate to physical sources / processes and also tell you why chasing after a perpetual motion machine, is not what people should be doing.

As I’ve said to you get out the pencil and paper and start drawing things out you should then realise where you should be going.

Clive Robinson • October 2, 2021 7:38 AM

@ SpaceLifeForm, lurker,

I would not use a phone where you can not pull the battery.

They exist. They are not iPhones.

More correctly they are not “Smart Phones”.

I’m still looking for a Smart Phone with a removable battery. However a friend who has similar views gave up looking.

Their solution is a small “Smart Pad” about the size of a large phone and a realy tiny phone with removable battery from a brand called ALBA.

They use the USB on the Smart Pad to talk to the ALBA phone, only when they need to go on-line.

In the UK that particular phone is less than around $15 equivalent and you can get “pre-pay” service from Supermarkets and even corner shops for less than $15 / month equivalent.

So throwing away the phone and SIM and getting a new pair each month, costs about the same or less than many mobile service plans for “Smart Phones” in the UK…

My friend uses a few other interesting tricks to get around actually making or receiving phone calls and likewise SMS but still appearing as though they do to others…

It’s all “good fun” and “totally harmless” but does show that even when others think they have the technology “all wrapped up” they infact don’t.

Clive Robinson • October 2, 2021 8:51 PM

@ MarkH,

LG Phoenix 405

Not sure if that was available in the UK when I last looked.

But the LG Phoenix 5 apparently has a 3000mA “embedded” battery not “removable”.

I suspect “embedded” is going to be not just the norm, but the only option in the near future…

The Smart Phone I use is something like a decade old and with carefull behaviour I’ve kept the battery alive sufficiently that it is still usable. Importantly it’s both 4G and LTE compliant so should still be good for a few years yet.

Clive Robinson • October 2, 2021 9:18 PM

@ SpaceLifeForm, ALL,

Strange. That is what Schrödinger’s Cat told me earlier tomorrow.

“Does the cat said” it would be a vomited dogs breakfast as well, because of,

“I discarded the date, hour and minute … the longer time scales have too much bias.”

@ ALL,

For those that are not aware time like energy/matter can be neither created or destroyed.

For relativity to work time has to be accounted for in the local refrence, where it remains constant.

Also in the local refrence the basic laws of physics requires all independent objects to record all events in their history no matter how far back in time you go. Otherwise you would not be able to reverse events, and that would cause all sorts of problems with energy/matter.

Thus you can not discard “the date, hour and minute” because the effects of those times will appear in any time window you chose no matter how small in duration. The same with the exponential curve of the half life it is after all a constant percentage change against local time.

So what to make of,

“I discarded the date, hour and minute … the longer time scales have too much bias.”

It shows not just a failure to understand the basic laws of physics, it is also a direct admission that there is bias which I’ve been saying from the very begining.

Further it also demonstrates the willfull behaviour to disgard facts, so as to “move the goal posts” to make a false argument…

Clive Robinson • October 6, 2021 6:42 AM

@ MarkH,

If anybody can consistently predict about 51% of the time, the outcomes suffer from some kind of bias.

Which is ambiguous due to “domains” and “dimensions” within them.

If you study only the “data” once removed from the final TRNG output then you can as you have found reduce but not eliminate the bias to some small value. One such way to do this –which is usually a key indicator of a bad TRNG– is the use of a crypto algorithm on the data as a “processing step”[1].

That is think of it as the inverse of “Garbage in gives Garbage out”(GIGO), that is “Bias in gives Bias out”, the simple fact of encrypting bias does not remove the bias it simply makes it too difficult for many to detect if they do not have either the “key” or access to the secret “trap door”.

But studying only the “data” once removed from the TRNG is actually a very bad idea. Because it removes it “from the system” which means you do not see other bias in other domains such as time / phase / frequency which can reveal bias in the data domain that is not otherwise visable.

I frequently warn about “Security-v-Efficiency” because without care “efficiency” makes systems one heck of a lot more “transparent” especially in the time / phase / frequency domains. That is “efficiency” opens up “time based” side channels etc in practical implementations[2] that then haemorrhage information even though the “data domain” appears secure.

Thus it matters not a jot what probability curves you end up with when looking only at the data domain you have to consider other domains in practical systems. Not just because actual information can be leaked via time based side channels, but they can leak triggers / indicators to reveal information in the data domain.

Thus the time between two outputs from a physical source carries information. If it varies in any way beyween two different outputs then it is a time based side channel carrying information out through the transparancy of the system.

Further you have to be very carefull that any processing steps you take, do not reflect the likes of “jitter” in the “time domain” into the “data domain” which unfortunately the latch / counter based roulette / waggon wheel stroboscopic system does.

But there is another problem with bias, it is multidimensional in all the domains.

I suggested you think about “Manchester Encoded” messages. If your “bias test” is to count the number of zeros and ones then Manchester Encoded mesages will pass with flying colours, but carry any kind of message you like through the test. It’s one of the major failing of the “von Neumann de-biaser”. If you look at a hardware implementation of it using an XOR gate and then look at a Manchester encoded data “decoder” you will see how similar they are.

But it gets worse as you move up in dimensions. Having used time based jitter to get “phase reversed” Manchester encoded bias through the standard stroboscopic and von Neuman debias circuits can you still detect the bias?

Well mostly not. If you examine a plain text message, it is detectable because it has easily seen bias in the statistics it has. But it is actually fairly simple to “flatten the statistics” yet have the message fully recoverable. One way is to take the statistics of the plaintext alphabet and map them to another reduced alphabet so say 28 values reduced to 10 values by using an intemediate 100 value translation[3]. Unless the test you use specifically looks for this then the message bias will get through.

Put simply for every test you can come up with, there is a trick to get bias past it.

It’s why I said those NIST tests are just a very low “low water mark” that any TRNG should pass, but they do not mean it’s any good. For instance a counter the output of which is AES encrypted will pass those tests with flying colours, but there is absolutly nothing random about the data output even though it passes the NIST tests.

So… If I make my system pause it’s output in time so that encodes “in time” the upper bits of the counter on the AES output, just looking at the data will never show bias… But the practical system will alow an adversary to easily recover the actual counter value and become synchronised to it.

Knowing this tells you, you have to decouple the data domain from the time or other domains significantly. Whilst easy in the abstract / theoretical way, it’s actually very hard to do with practical systems. It is why TRNG designers have to take significant care otherwise potentially usable bias will get through moving you away from your desired 50:50 even if very small. Remember these days crypto systems can be broken with bias as small as 1:2^80 or less a lot less. Likewise statistical models used in engineering can be thrown off by 1:2^6 bias.

As a TRNG designer you usually have no idea what a customer is going to use your TRNG for, or perhaps more importantly how. Whilst you could argue it is the customers problem, that is not a good thing to do for various reasons. One of which is you do not know what a state level adversary currently knows, and more obviously you have no idea what they will find out in the near future whilst the product of your design is still in use for a quater century or more[4], so your design needs to be conservative. So “getting it right” or atleast the best you reasonably can is important.

Whilst you can not stop bias or triggers in practical systems you should make efforts to reduce them in all domains and dimensions. Something that way to many “on chip” TRNG designers significantly fail to do in the chase for “efficiency” they fail to give “security” where it matters, and then they try to hide the failure behind determanistic algorithms which may well be broken in some way.

That is the practical reality, not theoretical hypothesis of life.

[1] When designing TRNG’s, for a long term security perspective, you have to assume that all “determanistic processes” are reversable, even the idea of the supposadly “One Way Functions”(OWFs). That is assume that even if you are not aware of it there might very well be a “trapdoor function” within the crypto OWF (which is what caused all the stink over the NSA and NIST approving their Dual Eliptic Curve DPRBG).

[2] A clasical example of this was how the NSA rigged the NIST AES contest. The result was that although AES has very high “theoretical security”, most “efficient” or “fast” “practical implementations” in practice are full of time based side channels haemorrhaging either KeyMat, PlainText, or both out through the rest of the “efficient” thus transparent system onto the external network. It is one of the reasons why the NSA only approve practical implementations of the likes of their “In Line Media Encryptor”(IME) for “Data At Rest”. It is also one of the reasons why I keep saying that if you need privacy / secrecy of your data you should use two computers one for processing and crypto that is NEVER connected to any kind of communications network including the mains power supply. And a striped down minimalistic computer to connect to any communications network you might need to use. You then using an appropriately safe method take encrypted data from the secure issolated / gapped computer to the insecure probably malware infested communications computer. That way you put your “security end point” out of reach of your “communications end point” something “Smart Devices” like mobile phones do not do, hence are easily susceptible to “end run” attacks no matter what crypto any App on the Smart Device uses. Hence why I say over and over “Secure messaging Apps are insecure by design” something that whilst provably true, apparently riles many “gurus” and “developers” who hang the “secure” tag on the Apps like a magic incantation, thus making the job of “collect it all” authorities much much easier as many “crooks” using their supposadly “secure smart phones” have found out in recent times…

[3] Known as a straddling checkerboard, this technique was popular in Russian paper and pencil “Nihilist Ciphers” right through untill the middle of the 20th Centure (see Vic-Cipher of the 1950’s). It is a very simple device for achieving a basic form of information diffusion called “fractionation” by converting a 28 letter alphabet into a 10 digit alphabet via a reduced 100 letter alphabet. Importantly it is not just simple to use it also achieves data compression relative to other schemes using 10 digit alphabet outputs.

To use a straddling checkerboard you simply make a three rows by ten columns grid and write the most frequently used 8 letters –A Sin to er– in the top row and the remaining letters, a full stop and “escape character” in the bottom two rows that are labled 8 and 9. If you get a frequent letter you simply write down the single digit column number, if however you get one of the less frequent letters you right down the row number and the column number as a two digit number. The resulting string of numbers has flatter statistics.

https://en.m.wikipedia.org/wiki/Straddling_checkerboard

You can to confuse enemies and waste their resources use the straddling checkerboard twice with a One Time Pad. The first time turns the plaintext to numbers that are then encrypted via a numeric OTP the output of which is easily recognised by eye thus “stands out” to anyone who is going to try to break the ciphertext. If however you take the numeric OTP output and use the straddling checkerboard to in effect decrypt it, the output then looks not like an unbreakable OTP, but very similar to a simple substitution or transposition cipher as it has what appear to be “natural language” statistics. Thus the unbreakable hides in amoungst what appear to be breakable traffic. But if you are using “Morse Code” to “transmit the message” the fact you are now back to letters not numbers significantly reduces the time you spend “on the air” which can also help save your life…

[4] Knowledge generally improves with time and what was not possible yesterday becomes just possible today, hard tommorow, and trivial the day after. Take Smart Cards for instance back in the late 1980’s early 1990’s they were thought to be secure, then first power analysis and differential power analysis enabled their internal function to be sufficiently mapped that the crypto functions became useless. In more recent times Smart Cards have been used for National ID and similar cards, and have onboard TRNG’s, that unfortunatly alowed bias into the generation of numbers such that the cards were no longer considered secure.

Clive Robinson • October 7, 2021 7:47 AM

@ MarkH,

Suppose that a radioisotope TRNG has an average of λ decay detections per second.

Be cautious about,

λ e^(-λ t)

Because λ amongst other things can be misused.

In a perfect world it does not matter if you use the initial λ in a chain of measurments or the current λ at the start of each measurment in the chain as the time component will account for that.

However in reality our measurments are imprecise so are our calculations of “e” so the error rate is different with each method due to curtailed precision and other sampling and curve fitting issues.

Normally error functions are “hand waved away” that is they are “assumed” to act like “Additive white Gaussian noise”(AWGN) as it makes the maths tractable.

This is because the individual errors can then be assumed to be random around the average point of measure as the AWGN model assumes that all measurments are “independent” thus “sum out” or “average to zero” not “dependent” and thus carry forward by accumulation (the reality is the average is moving witg time due to the % of a % decay). Worse the effective error rate also rises.

This is because time is a continuous process thus any series of measurments made are not actually independent, it’s why you get “phase accumulation” in counter usage. Hence the reason the actuall error function whilst “looking random close in” in fact shows a clear waveform usually balanced around the measurment point when viewed correctly. As I’ve mentioned you can get with suitable integration a sinewave or sawtooth wave or similar depending on the measurment.

But… What if the measurment point is not constant but biased by a trend, or likewise what is being measured is not fundementaly balanced about zero or has changing bias?

Either way it accumulates in the readings, and what you see is very much dependent on three things,

1, The method of coupling the instrumentation head to the source.
2, The various measurment windows of the instrumentation head.
3, The actual method of measure.

Again to make things simple people create inapropriate windows and use inapropriate methods. For instance the concept of “AC coupled” is in reality “bandpass coupled” and may have some degree of less obvious very low frequency or even DC coupling (hence people use “lossy integrators).

A clasic example being a misunderstanding about “grounds” can turn a “buffer amp with roll off filter” into a high frequency oscillator (redraw a LC pie lowpass so that the two caps to ground are joined together but not to the refrence ground, you get a tuned circuit which if you redraw it around an op-amp circuit it will toot…).

But there is also a big issue with the use of statistics and examining the output. It’s “normalisation” if you take two period measurments and graph out the readings you will normally get something aproaching a normal distribution or bell curve. If you take two such measurment periods a significant time difference appart you are going to find you have problems comparing them. Thus the normal fiddle is to “normallize” the readings in some way. This can cause all sorts of problems.

Firstly consider ALL measurments are discreate NOT continuous you then perform some form of average on them and plot them on a graph centered on your chosen average.

But due to ranging on instruments the curve tails are of increasing inacuracy compared to those close to the average and may be useless beyond a quite small range. But how do you compare two time period measurments when the first has about twice the number of actual data points to the second?

Obviously the reading density is down which means that likewise the readings that fall in any time sub range change as well. How and by how much depending on how you measure them.

Oh and also how you group them, the readings might be 32bit, but in reality around 3-4 bits less at the expected average and worse at the tails. Then, you scale them down to maybe 5-7bits to make your table to plot your curve. If you are aware of the implications of Pascal’s triangle the number of readings in each range follows a natural distribution curve (see Gault board). Normalisation unfortunately “hides” things such as the time shifting mean giving a distortion that favours the left hand tail over the right whilst also making the mean steadily of less accuracy. Which means normalisation “lifts the noise floor” which is fine if AWGN but if not –and it’s not with a radioisotope source– makes things a whole lot more complicated. So normal statistical measurments will leave you prey to the old truism of,

“There are lies, damn lies, and statistics”.

And that’s just some of the stuff that is relatively easy to see…

Clive Robinson • October 8, 2021 8:37 AM

@ FA,

Re. the RBG as presented by @MarkH, you have asserted

Oh dear yet another fantasy / false statment.

It was @Freezing_in_Brazil that raised the question of using radioisotores as a source for a TRNG.

I pointed out the source had a bias (which despite all logic you imply is false).

I also pointed out that without care the bias could appear in the TRNG output.

Now if you realy think as you appear to do that either of those statments are false or incorrect come up with some evidence rather than moving the goal posts and making statments that have been shown to be not what you claim.

To be quite honest you hitching onto the waggon @MarkH is trying to pull was a daft thing for you to do. Worse rather than bow out gracefully as I’ve given you repeated opportunities to do, you some how see it as an offence to your manhood or dignity or some other squirrel running around inside your head.

I suggest instead of kicking out with nonsense like,

Instead, you constantly appeal to your own infallible authority.

You actually go and do a little thinking, that you are so obviously not doing right now.

Clive Robinson • October 9, 2021 4:36 AM

@ MarkH,

He didn’t think this was useful, because with each speed-up of the counter, the likelihood became smaller that a decay would be detected before the maximum count was reached

What you are describing there is not a roulette wheel / waggon wheel system as previously discussed.

Further,

For example, if μ is one percent of the average time between decays, then decay at the start of an interval of length μ is one percent more probable than at the end of the interval.

You are clearly describing an exponential time bias, but you forgot to mention the point I’ve previously made, that no matter how short the time interval chosen the time bias is still there and provably continues to increase. Also because we are dealing with measurments of past events not future probabilities we can see that the bias accumulates as you would expect when you integrate the measurments[1].

It follows that even if you split the measurment into the slowly changing exponential time and what you think is random noise, the noise will still have exponential change, thus it is clearly biased. You are in a “turtles all the way down” situation, your measurments are biased. Also not only does the “time bias” get through the roulette wheel or other counter based measurment system it also gets through the XOR based von Neumann de-biaser.

It will unless you take care get through all the following systems as well either through the data domain or through the time domain, because of the nature of the general problem of “Security-v-Efficiency” that causes side channels that leak information about the source, that they are “transparant” to.

Which is the provable points I made to @Freezing_in_Brazil, and have been making since of,

1, The radioisotope source has bias.
2, The bias gets through to the output of the TRNG unless you take steps to stop it.

[1] Traditionally in mathmatics there are two basic types of proof, firstly “graphical” secondly “logical”. I’ve previously described a way you can prove the bias gets through a roulette wheel or other type of counter based measurment by the graphical method of drawing out the time base of a latch based system driven by two inputs one to the CLK input and one to the D input, and how integrating what looks like “random” output into a waveform that is very clearly not random. In the case of two oscillators you get a very nice sinewave at the difference frequency. As @Weather showed a sawtooth with a linearly changing ramp. If you feel like using an exponentially changing period then you will get an exponential curve after integration. The simple fact is “time bias” gets through the measuring detector, the graphical proof demonstrates that. It also gets through all the following stages eventually unless you take specific steps to stop it doing so, and those steps are generally not easy to get sufficiently right.

Clive Robinson • October 9, 2021 11:00 PM

@ MarkH,

As I explained above when I wrote about “moving the goal posts,” I am not using “bias” to mean potential side channels (have you ever seen the word used that way in cryptographic literature?). If by “time bias” you mean potential side channels, that’s not part of my present analysis.

What we are talking about is the ability for someone to potentially gain a better than 50:50 advantage from the TRNG.

Any bias that makes it to the output of the TRNG that an attacker can detect means they have the ability.

I have shown that,

1, There is bias in the source.
2, That bias passes through the stages of a standard TRNG measurment.

Thus I have proved that my original comment to @Freezing_in_Brazil is true.

However you want to in effect say “so what” with,

the bias in the output numbers can be reduced to an extremely small magnitude.

But you do not say if you are thinking on a single measurment or a chain of measurments.

As I’ve further proved the bias is accumalitive which means it will over time build up.

Unfortunately your,

If by “time bias” you mean potential side channels, that’s not part of my present analysis.

Indicates that your “present analysis” is not relevant to any argument or point I’ve made.

Especially when you appear not to understand what the time based side channel gives an attacker, which is a method by which the small signal can be pulled from the noise…

Several times in the past I’ve mentioned that the I believe the NSA rigged the NIST AES contest. That is the rules of the competition actively encoraged “side channels” to occur in practical implementations of AES.

So even though AES is theoretically secure to some rediculous level, the time based side channels in practical implementations reduced the work involved to break an actual implementation to just passively watching bias in the timing, which leaked the key information quite far across the network. Because the systems involved had suffered from “Security-v-Efficiency” issues in the design stages they were “transparant” to time based side channels.

The thing is that every time the measurment head picks up a decay product it marks a point in time. That point in time works it’s way through the TRNG as a time based side channel. This enables an attacker to make their own “measurments” and compare them to that of the TRNG. They can then in effect “synchronize” their counter to that in the TRNG.

As everything after the counter in the TRNG is both “determanistic” and “known” it matters not a jot how much “magic pixie dust” crypto grade hashing you add.

It’s why the designer has to break the time based relationship.

As I have noted some “entropy pool” –but not all– designs break the relationship sufficiently that an attack is not possible.

Now if you have a disagrement with that then say so as well as why.

Likewise if you want to chase down bias on a single measurment at least be very clear what it is you are stating, and that it is not relevant to what I’ve said. Oh and also give the bias in terms of “required number of bits” to represent it. Saying 0.999999999 might look good but it is aproximatly 30bits to register it, or if the bias accumulates, as it does with a radioisotope source, then 29bits with two measurments and that the number of bits keeps decreasing with the increasing number of measurments. So it goes down to 28bits with another couple of measurments and so on.

Clive Robinson • October 12, 2021 2:36 AM

@ MarkH, ALL,

seems to suppose that the time allowed for each measurement is fixed, and further that it should (or even must) be fixed at the mean time before the next decay. Did I understand correctly?

You are asking two actually independent questions there,

1, Fixed Measurment.
2, Fixed mean.

So two answers.

Answer 1
As I’ve noted previously with the roulette wheel / waggon wheel measurment system there are two inputs the Data or D-input and the CLK input and an output Q. Likewise a counter has two inputs.

Now depending on which way you connect the inputs depends on what you measure, frequency or time. But you need to remember either can be a valid measurment for use in a TRNG.

So you can count the time between decays in the population N, or you can count the number of decays in population N in a given time period. Both will record the exponential change in the source output formed by population N. That is time will increase and frequency will decrease exponentialy as population N ages.

However one thing is clear, despite not being able to predict when an individual atom will decay, when dealing with a population N, if N is large or the measurment period is large, the number of decays in that time period or the time period for a number of decays becomes more and more predictable.

So two effects logically must be occuring one is the obvious exponential half life, the other is that for every long or short decay there is a balancing decay or decays otherwise there would be no averaging to the half life curve.

Answer 2
You set the argument for 50:50, I’ve simply pointed out that due to the exponential decay, for any given time period that 50:50 can only happen at one point in a given population N aging.

Something I’m assuming you won’t contest.

To claim otherwise would imply a belief that science would not agree with.

Someone has already claimed that the count period calculation given in the paper you quoted did not have a term that changed with time. The implicit implication of that claim being,

1, That the count remained invarient with time (ie constant).
2, Therefore the decay rate must likewise be constant.

Now, for that to be true, either new radioisotopes would have to forever magicaly appear in the population N, or the person implicitly believes in perpetual motion devices. Because each decay is giving out energy from the source to the detector, so with a count output that does not change with time the energy output would be constant for ever without any balancing input of energy or it’s dual matter…

Clive Robinson • October 12, 2021 7:27 AM

Not to rely on quoting authorities, but it is worth noting that Gauss stated that it is an error. Since true science is about that which exists, and actual infinities do not exist, this has damaged mathematics.

We live in what is currently believed to be a finite universe. So from the prospect of energy/matter being finite then Gauss’s “true science” is likewise finite in some respects.

However I’m not aware of anyone with sufficient knowlesge claiming maths is “true science” or “real science” or even science.

Maths is the equivalent of a drawing or model, it helps explain not just what goes on in science but many of the affairs and creations of man that have no basis in science what so ever (think finance etc).

You could argue that science follows a line through physics, chemistry, biology and at some point when objects of energy and matter have the ability to make what appear to be choices, science either ceases or changes.

That is a point is reached in the sense where fully determanistic mathmatics ceases to be a valid descriptor and statistical / probabalistic methods start to be the only way forward.

Some say it is the boundry between “hard and soft science” others indicate it is where philosophic reasoning takes over from the various logics by which fundemental maths is formulated.

Either way you could say that neither maths or philosophy are “true science” or even science at all. They are in fact just frameworks in which “true science” can be described and modeled in limited ways.

As for infinity, does it exist in a meaningful form in a finite univers?

Well if you can “name/count it” no, as by definition any countable integer is finite, that is it has a logical successor so can not be infinite. So you keep counting forever and no matter how fast you do not reach infinity. Arguably between any and every two integers there are other numbers, those that can be found as ratios of integers, but between them there are other numbers some of which have infinite sequences such as 1/3 due to the integer base / radix used to express them and others that are infinate because they are not representable in any integer base, thus “go on for ever”. The number of these “go on forever” numbers is not just unknown it can not be quantified in any meaningful way in “natural maths”. However the fact they can not be quantified does not stop them existing or of being of very real use by various induction methods. After all come up with a realistic definition of the number represented by “zero” you very quickly run into trouble unless you have the concept of “infinite” because otherwise what would 1/0 be? How about 0/0?

Clive Robinson • October 12, 2021 10:06 PM

@ Sut Vachz,

His proof only holds if you accept that actual infinities exist.

I both do and do not think that “infinities exist”, and no I’m not mad or likely to go mad from this belief (unlike some mathmaticians around Cantor’s time are reputed as having done so).

Further my reasoning for both is rather more obvious than both set theory and logic.

Firstly we have reason to believe our universe is finite and importantly is bounded. Which anyone who has studied thermodynamics knows makes it a special case.

What is in question is if it is bounded in time or not, for which currently there are no “obvious” answers.

Why is time important?

Well we believe the universe is expanding in volume in what we belive is a non finite space. That is simplistically think of it as being inside a ballon that is being inflated, but we can not look outside of the ballon to see if there are any external limits.

If time is not bounded then the Universe will at some point expand to some definition of infinity.

But further consider there is a very real difference between information and the duality of energy/matter. Science currently believes that energy/matter is “granular” and has a smalest size for objects.

Therefore the universe is made up of a finite number of finite objects and as such is discreet. However the space they occupy is expanding towards infinity and as such is continuous.

Whilst the former does not alow for infinity, the latter does at some point in time.

But… even if the Universe is made of finite objects in a finite space, this does not exclude the potential for infinity.

Consider how the discreet finite objects can be placed in a continuous space, it presents you with an infinity of possible positions for the finite objects to be positioned in.

But further, consider “natural numbers” or integers from 1 upwards.

There is the very reasonable assumption that every integer has a successor, therefore no mater how big a number is there will always be another number bigger. But from that it follows that every number has a predecessor thus we have negative numbers that arguably do not have a “natural form”. That is whilst I can give you ten apples, I can not give you minus ten apples. That is whilst positive integers have physical meaning, the negative integers only have meaning when we consider the movment of physical objects.

But we also know that fractions are meaningful within the integers when drawn on a line. That is I can give you 1/2 an apple, or 3/4 of an apple and so on with an integer divided by an integer to give a ratio that can be scaled to fit between any two points.

What Cantor also showed was that despite those integers being infinite, in a continuous space, there would always be other numbers that due to the spacing between integers could not be represented by any integer or ratio of integers even though the integers are finite, they are still discreet not continuous.

So the bottom line is continuous alows infinity of position to exist even though the points of refrence are disreet and finite.

Which is kind of what you would expect with “scaling” for any given ratio it can apply across an infinite range.

To see this consider standing between two infinite parallel lines. As they go into the distance from the point of the observer those lines become the same point even though no matter how far you travel along them you will never get to such a point as it does not physically exist, but it does exist in terms of observed distance / effective movment. How do you explain it in a meaningful way without accepting that the finite and infinite can co-exist in an observed universe.

Clive Robinson • October 13, 2021 11:14 PM

@ SpaceLifeForm,

As to a Practical TRNG device, I believe that the decay detector would have to be a sphere, with the radioactive source inside. And, then hope that none of the decay events can tunnel thru your detector, un-detected.

That is what you would need if you wanted to catch all decays, as you would in a “nuclear battery”.

However the assumption is a uniform source…

That is the decay output is on average the same in all directions for a sufficiently large source.

So… If you have a large population size N then you will get a total of X particles decaying in a given period of time. If however the source is uniform and you only monitor 1/12th of the surface you expect to get X/12 of the particles. Or in effect you actually have a population size of N/12.

That is you would expect to be further down the half life curve, but as the curve is the same “% of a %” you would expect to see on average the same distribution etc but with the count rate the same as a source with that fraction of the population N.

The thing about “distributions” is they are for significant measurments not sparse measurments. You can see this on a Gaulton board as you reduce the number of balls or watch one in very slow motion. Look at it this way if you have a relatively large number of bins at the bottom you have “no idea” which bin any given ball will drop in, so the first very few balls look to be totaly random. But as the number of balls increases the distribution will start to appear as expected.

If you watch several runs of a Gaulton board in slow motion you will see a number of things happen, then follow the thinking through in terms of reducing the number of balls exponentially.

Clive Robinson • October 15, 2021 1:51 AM

@ SpaceLifeForm,

If the detector misses the event, does that mean that Schrödinger’s cat gets to live?

Logically yes.

And now you are “joining the dots”… Distributions only work on mass.

Now ask the questions about “sparcity and random” and “what is sparce”.

That is how many balls in a Goulton Board are needed to show a “normal distribution” from a “flat distribution”?

Clive Robinson • October 16, 2021 6:44 AM

@ MarkH, ALL,

Clive has gifted us with the wonderfully visual metaphor of a roulette wheel. Perhaps a “wheel of fortune” is more appropriate.

Not my name, not sure who chose it but it’s,easy to see the wheel spining at a near constant rate with a ball running at an approximately constant rate but puterbed by the diamonds.

As I said unless you are using just a single latch you are using a clocked counter circit. Depending on which way around you connect them it is either a frequency counter or a period counter.

As you describe it,

Unlike the wheels used in gaming, this one spins all of the time, at a (nearly) constant rate.

That would be a fixed frequency oscillator, but is it driving the D input or the CLK input of a latch or the count and gate inputs of a counter.

that each time the TRNG detector captures an ionizing decay particle,

This implies that the output from the particle detector is controling when a reading is made.

this triggers a strobe light of such short duration that the wheel seems to be “frozen” for a moment

So the particle detector is controling the “gate” signal on a “counter”.

So what is being measured is the time in oscillator periods with a loss of precision on a single reading due to the signal ariving part way through a counter period.

But if the counter runs continuously that loss of precision has to carry forward into the next count, and so on repeatedly untill the fractional count periods become equal to a full count and shows up as one more or one less “count” in the reading.

There is a well known technique where using a frequency counter or time counter of say 3 decimal digit precision you take ten readings, average them and get an extra digit of precision[1].

@Weather produced a set of graphs that show this phase accumulation occuring.

Now the important thing to remember is,

Whilst in the data domain this may look random it is only because you have lost the information from the time domain

If you can get the time refrence back, then you can fairly easily “phase lock” another oscillator to the oscillator driving the counter and so get the same numbers from another counter.

Think on that for a moment.

That is if an attacker can get the time refrence and the data they can synchronize their oscillator thus their counter as accuratly as they like to that of the TRNG.

As long as their oscillator remains synchronized which it will for long periods of time –look up loose locked oscillators– then they can recover the “random” from only the information coming from the time domain.

Even if their oscillator drifts a little, their “data” will be within one or two count errors which means the “search space” is very small[3].

Now do you understand why I say stoping the time based side channel is so important?

Now even if you add some crypto algorirhm to the data before you output it you have two basic options,

1, Reversable algorithms.
2, Oneway algorithms.

To remove the effects of the first you only need the key.

To remove the effect of the second is easy if it has a trapdoor function you know about. But failing that because you have access to the leaked time information you know within a fairly good guess what the actual data value is so you have a quite small search space in which to find it and use a “buck saw” method to lock into it[3].

It’s why you care not a jot how predictable or not your random source is, because you are not predicting anything, you are using things that have been measured, and as an attacker you can measure the measurment if a time based side channel exists that you can get access to. That in modern “efficient” systems is all to easy. Heck Intel provide you with access to very accurate,timers within the CPU that are driven by the same oscillator the rest of the chip is and that sort of noise gets around.

So the question you might now be asking is “Can you turn this into a practical attack?”.

Well the answer is I’ve built and demonstrated a system back late last century that showed you could do it not just through the “roulette wheel” circuit but the following XOR based de-bias circuit. Look on repeating it as a graduate level project.

But there is an old saying,

“The proof is in the pudding”

In this case the “pudding” is a timing diagram as a “graphical proof”.

[1] If you think about it for a moment it is equivalent of adding the circuitry required for an extra digit of counting and changing the effective count rate by ten. So insted of counting say 314 and an unknown fraction on a single short reading you count 3141 with a longer count. That is those 1/10th fractions accumulate[2].

[2] There is another technique that has been around for a while invented by an engineer at the UK company RACAL where you use the fractional accumulation to correct the phase of a phase locked oscillator. The net result is you can control the frequency of an oscillator to some fraction of the refrence frequency. It’s called “Fractional N Synthesis” and there are two ways you can do it, by using an analog phase correction with a D-A circuit, or by changing the divide ratio of the “pre-scaler” counter from say 10 to 11 thereby “swallowing a pulse” thus changing the divide ratio by 1/10 for that cycle. It is important to understand the importance of the improvment made at UK company Marconi by the use of a random signal,

http://www.aholme.co.uk/FracN/Synth.htm

Remember this is a reciprical process if you do not loose the time refrence.

[3] Because of the reciprocal nature of the way this works you can use a “buck saw” method to home in and lock the oscillators and counters using only very occasional reads of the data. Which as it pulls out any bias in the source can be used to “track the average” thus feed it back to reduce the search space.

Clive Robinson • October 17, 2021 2:50 PM

@ SpaceLifeForm,

Don’t you mean backdoored instead of trapdoored?

A deliberate “backdoor” in an encryption algorithm is usually by a “trapdoor” function.

But trapdoors can come into existance by lack of knowledge which is why some early PubKey’s were not as strong as expected.

So “trapdoored” covers the method intended or otherwise, whilst “backdoored” covers a specific intention.

Clive Robinson • October 21, 2021 6:11 PM

@ MarkH,

…advantage to an attacker is not relevant to the performance of the correct design.

The trouble, first find a “correct design”…

As a rough rule of thumb the accumulated error at the end of the whole year would be ~half the mean of the half life at that point.

You can see this graphically with a Gaulton Board the first ball to drop falls anywhere but has a very significant effect on the average. Each ball thereafter has successively less and less effect on the average, to at some pont it is vanishingly small[1]. However the probability of which slot the ball drops into is still the same as the first ball.

In effect you see the same entropy on the edge of the first decay at say 1e-5secs as you do on the edge of the last decay in the year at 31557600secs.

Which means the optimum stratagy for getting entropy out is to grad the diference in the period between decays with as much resolution as you can measure (that is the fastest running oscillator you can get).

However a dirty little secret of high frequency oscillators is most are “XTAL overtone” which means the higher the frequency the more stable the oscillator is (ie the less “pull” there is).

Stability in the oscillator is bad news as it makes synchronizing to it by an attacker that much easier.

Now a little secret that is not widely known “Make the radioisotope source ‘self clocking'”.

That is put two particle detectors on the source, one either side. Take one to the D-input on the latch, the other to the CLK to the latch.

Not only are they both as unpredictable as each other they both decay at the same half life rate thus remain balanced[2].

[1] Though unrelated if you have a CS-PRNG built from a counter and a block cipher, you also get a decrees in observed entropy if you don’t take care. That is the first output is say 1:2^56 but the millionth ~2^20:2^56, eventually you will get to (2^56 -1):2^56 meaning the last output is 100% known. That is you are in simple counter mode, in effect taking a ball out of the urn each time you draw, but not putting the ball back so the number of remaining balls in the urn decreases steadily. The solution is to use the block cipher in a feedback mode. That is XOR the counter output with the previous output from the block cipher, and use the result as the next input to the block cipher.

[2] There are however still a whole haystack of other issues to resolve.