TRNG

PuTTYgen/MobaKeyGen

ランダムデータの元になるようマウスを動かしてあげないと処理が進まない ので注意です。これぞ人力による、真の乱数発生です。

putty-0.80/windows/puttygen.c

static const char entropy_msg[] =
    "Please generate some randomness by moving the mouse over the blank area.";

            /*
             * Manual entropy input, by making the user wave the
             * mouse over the window a lot.
             *
             * My brief statistical tests on mouse movements
             * suggest that there are about 2.5 bits of randomness
             * in the x position, 2.5 in the y position, and 1.7
             * in the message time, making 5.7 bits of
             * unpredictability per mouse movement. However, other
             * people have told me it's far less than that, so I'm
             * going to be stupidly cautious and knock that down
             * to a nice round 2. With this method, we require two
             * words per mouse movement, so with 2 bits per mouse
             * movement we expect 2 bits every 2 words, i.e. the
             * number of _words_ of mouse data we want to collect
             * is just the same as the number of _bits_ of entropy
             * we want.
             */

Windows10とか用のコードなんで詳しく見る気Nothing。

代りにOpenBSDの乱数発生装置を傍観してみる。ハードなんでドライバーだな。 man -k random | grep 4 とかやって、ドライバーを列挙してみた。

amlrng(4) - Amlogic random number generator
bcmirng(4) - Broadcom RNG200 random number generator
bcmrng(4) - Broadcom BCM2835/BCM2836/BCM2837 random number generator
mvrng(4) - Marvell ARMADA 7K/8K random number generator
octrng(4/octeon) - octeon random number generator
omrng(4/armv7) - OMAP random number generator
qcrng(4) - Qualcomm Snapdragon random number generator
rkrng(4) - Rockchip random number generator
stfrng(4/riscv64) - StarFive JH7110 random number generator
vrng(4/sparc64) - virtual random number generator

どれでもいいんだけど、chipに反応して、rkrndを参照。

NAME
     rkrng - Rockchip random number generator

SYNOPSIS
     rkrng* at fdt?

DESCRIPTION
     The rkrng driver provides support for the random number generator found
     on the Rockchip SoCs.

     It feeds the random subsystem's entropy pool with 256 bits of random data
     every second.

fdtってまとまりでSoCsなデバイスを管理してるのか。で、その性能は 256bit/s とな。

dev/fdt/rkrng.c

/* True Random Number Generator (TRNG) */
#define TRNG_RST_CTL                    0x0004
#define  TRNG_RST_CTL_SW_RNG_RESET              (0x1U << 1)
#define TRNG_CTL                        0x0400
#define  TRNG_CTL_RNG_START                     (0x1U << 0)
#define  TRNG_CTL_RNG_ENABLE                    (0x1U << 1)
#define  TRNG_CTL_RING_SEL_MASK                 (0x3U << 2)

rkrng_match(struct device *parent, void *match, void *aux)
{
        struct fdt_attach_args *faa = aux;

        return OF_is_compatible(faa->fa_node, "rockchip,cryptov1-rng") ||
            OF_is_compatible(faa->fa_node, "rockchip,rk3288-crypto") ||
            OF_is_compatible(faa->fa_node, "rockchip,rk3328-crypto") ||
            OF_is_compatible(faa->fa_node, "rockchip,rk3399-crypto") ||
            OF_is_compatible(faa->fa_node, "rockchip,cryptov2-rng");
}

rkrng_rnd(void *arg)
{

        for (off = 0; off < 32; off += 4)
                enqueue_randomness(HREAD4(sc, sc->sc_v->dout + off));
:

ここで得た乱数は、キューに入れられて、dev/rnd.c により、デビューするん だな。

/* Return one word of randomness from a ChaCha20 generator */
u_int32_t
arc4random(void)
{
        u_int32_t ret;

        mtx_enter(&rndlock);
        _rs_random_u32(&ret);
        mtx_leave(&rndlock);
        return ret;
}

sys_getentropy(struct proc *p, void *v, register_t *retval)
{
        struct sys_getentropy_args /* {
                syscallarg(void *) buf;
                syscallarg(size_t) nbyte;
        } */ *uap = v;
        char buf[256];
        int error;

        if (SCARG(uap, nbyte) > sizeof(buf))
                return (EIO);
        arc4random_buf(buf, SCARG(uap, nbyte));
        if ((error = copyout(buf, SCARG(uap, buf), SCARG(uap, nbyte))) != 0)
                return (error);
        explicit_bzero(buf, sizeof(buf));
        *retval = 0;
        return (0);
}

次は、乱数発生器を駆使して、10Mの乱数ファイルを作成してみる。対比とし て、ZERO埋めのファイルも作成。

ob$ dd if=/dev/zero of=ZERO bs=1M count=10
10+0 records in
10+0 records out
10485760 bytes transferred in 0.035 secs (296108496 bytes/sec)
ob$ dd if=/dev/urandom of=RND bs=1M count=10
10+0 records in
10+0 records out
10485760 bytes transferred in 0.129 secs (80952048 bytes/sec)

やっぱり乱数発生の負荷があるので、4倍ぐらい遅くなった。

ob$ ./ent ZERO
Entropy = 0.000000 bits per byte.

Optimum compression would reduce the size
of this 10485760 byte file by 100 percent.

Chi square distribution for 10485760 samples is 2673868800.00, and randomly
would exceed this value less than 0.01 percent of the times.

Arithmetic mean value of data bytes is 0.0000 (127.5 = random).
Monte Carlo value for Pi is 4.000000000 (error 27.32 percent).
Serial correlation coefficient is undefined (all values equal!).

乱雑度は、当然ながら全く無い。従ってギンギンに圧縮できますよと。

ob$ ./ent RND
Entropy = 7.999984 bits per byte.

Optimum compression would reduce the size
of this 10485760 byte file by 0 percent.

Chi square distribution for 10485760 samples is 238.00, and randomly
would exceed this value 77.05 percent of the times.

Arithmetic mean value of data bytes is 127.5264 (127.5 = random).
Monte Carlo value for Pi is 3.141491372 (error 0.00 percent).
Serial correlation coefficient is -0.000032 (totally uncorrelated = 0.0).

十分に乱雑。これを使えばパイもそれなりの精度で予想できます。

パイが出てきたのでパイしてみる。まずは、入手だな。

ob$ maxima
(%i1) fpprec:50;
(%o1)                                 50
(%i2) bfloat(%pi);
(%o2)        3.1415926535897932384626433832795028841971693993751b0

特殊な人向けの方法。

ob$ echo 'scale=50; 4 * a(1)' | bc -l
3.14159265358979323846264338327950288419716939937508

まあ、ちょっとunixを利用してる人用。

ob$ ruby -r bigdecimal/math -e "puts BigMath.PI(50).to_s(?F)[0..-2]"
3.14159265358979323846264338327950288419716939937510582097494459230904962935244281

アンチpython人は、rubyをチョイスするのさ。とか言いつつDebianに入って いなかったんで、慌てて入れたのは内緒だ。10万桁を計算させたら22秒だった。

ob$ ./ent -c PI
Value Char Occurrences Fraction
 10                1   0.000010
 48   0        10002   0.099986
 49   1        10138   0.101346
 50   2         9911   0.099076
 51   3        10027   0.100236
 52   4         9977   0.099736
 53   5        10027   0.100236
 54   6        10034   0.100306
 55   7        10031   0.100276
 56   8         9982   0.099786
 57   9         9904   0.099006

Total:        100034   1.000000

Entropy = 3.322046 bits per byte.

Optimum compression would reduce the size
of this 100034 byte file by 58 percent.

Chi square distribution for 100034 samples is 2460888.86, and randomly
would exceed this value less than 0.01 percent of the times.

Arithmetic mean value of data bytes is 52.4931 (127.5 = random).
Monte Carlo value for Pi is 4.000000000 (error 27.32 percent).
Serial correlation coefficient is -0.002000 (totally uncorrelated = 0.0).

バイナリー・データを期待してるにもかかわらず、テキスト・データを与えて しまったので、こんなグタグタな結果になってしまった。せめて、数字の出現 度を目カイ二乗検定してやってください。