Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

For entropy sources that measure the environment, are there attacks where the attacker manipulates the environment? For example, when the source is measuring the temperature, an attacker could alter the temperature near the sensor to create more predictable random numbers?

Related: And does software detect if a sensor is broken or a poor source on entropy? Like if it broke and locked itself on to the same constant temperature reading?



That's why you only use the least significant digits of any number that comes from a sensor.

So if the temperature changes from 65.78614329 degrees to 66.24667182 degrees, you don't take 65 and 66, you take 329 and 182. Those digits are most likely to be random noise and not something an attacker can manipulate at will. Even if the analog part of the sensor is stuck at the same temperature as in your example, the digital reading will probably fluctuate around that value with plenty of random digits.


> you don't take 65 and 66, you take 329 and 182.

you take all of them and run it through an appropriate extractor. it is very easy for ADC error to have structure and bias.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: