How does TrueRNG compare to Entropy Key

[neoaeonMember]

Entropy Key, the other (currently unavailable) low-cost enthusiast HWRNG, lists a plethora of technical information on their site that TrueRNG hasn’t yet posted.

http://www.entropykey.co.uk/tech/

How do they compare?

On key points from Entropy Key’s site; such as:
* Method – I believe Entropy Key and TrueRNG employ the same method of high voltage P-N junction avalanche noise generation. True?
* On device bias and correlation detection – Entropy Key checks for correlations between the raw streams, as well as bias in the streams, the XOR’d final stream as well as on the debiased stream and will shut itself down if any correlation or low entropy states are detected. Does TrueRNG have a similar function?
* On device PRNG – Entropy Key has a PRNG where the debiased stream packets are mixed in a pool before being sent to the host. The specific algorithm isn’t described by Entropy Key. Does TrueRNG have this function?
* On device entropy tests – Entropy Key runs FIPS 140-2 tests on the final data before sending to the host and will shut down if too many FIPS tests fail. Appears to be on device rngtest. Does TrueRNG have a similar function?
* Encrypted sessions – Entropy Key encrypts the random data from the device to the host and uses a custom daemon to pick up the authenticated random packets. I don’t believe TrueRNG has this function as the instructions are to use the serial output as a random device directly in Linux. This is true? (I guess this function is for preventing eavesdropping on the USB bus)
* Tamper Resistance – Entropy Key is epoxy filled to resist being taken apart. Does TrueRNG have any such feature?
* External bias resistance – Entropy Key includes a temperature sensor to detect external biasing. Does TrueRNG have anything similar?
* Block diagram – Entropy Key publishes a very nice block diagram describing the design of the device eloquently for the layman. Will TrueRNG provide such a diagram?

In General, it appears the TrueRNG is equivalent to the HWRNG side of Entropy Key without the application processor (Cortex-M3) providing higher level functions such as on-device correlation and bias detection, rngtest, PRNG mixing, and integrity and confidentiality functions. Is this a fair assessment?

Thank you in advance for your time.

[Ubld.it StaffModerator]

Wow, lots of questions! I will try my best to answer them all.

The specifications for the TrueRNG are published on this site. We do indeed utilize the avalanche effect in a semiconductor junction for noise generation. We can’t comment on how the Entropy Key, or any other device operates. We haven’t done comparisons nor do we have one of their devices.

We don’t see a need for XOR with a PRNG. The data produced is sufficiently white for most purposes. For a 1GB file, our testing showed a mean value of 127.5115 (.009% bias). This may be further reduced by additional whitening techniques that may be implemented in software if your application requires it.

The TrueRNG doesn’t do on-device FIPS 140-2 testing. In the scenario where we seed the Linux kernel, this is performed by the rngd-tools daemon. Any custom application can be implement this as well if this feature is desired. In the case of sensitive applications relying on on-device testing, there is still a chance that the device or method used is flawed and still need to verify your entropy.

The TrueRNG doesn’t authenticate packets going over the USB bus. If you have someone snooping on your USB bus, or performing a man-in-the-middle attack then you have bigger problems to worry about i fear. Also I would have to question implementation, a pre-shared key would be known, and the risk of man-in-the-middle attack could still be present.

The TrueRNG doesn’t have hardware tamper resistance. If you are concerned with security at this level, you should be looking at a much more sophisticated device with certification and independent testing with an audit trail. I’m sorry at this time we do not offer this service.

We don’t attempt to detect external manipulation of the random stream. If you have someone within a close enough proximity with sophisticated enough equipment to manipulate this stream without disrupting other devices then again, you probably have bigger problems to worry about! We have however done in-house testing of trying to persuade the random stream, but we found ourselves destroying the device before that actually happened.

With all that being said, the TrueRNG is meant to be a low-cost hardware random number generator that is **actually available for purchase**. There are many other devices that cost a lot more which implement additional features if your application requires them.

Thanks for the questions!

[Author]

Posts