Re: Happy New Year!

The problem of random numbers is vexing and complicated because it is 
intensely cross-domain.  From the perspective of one domain (hardware?), 
it seems easy.  But there are other issues that bite in other domains, 
rendering an "obvious" solution useless.

To OP's suggestion, a hardware solution is practically useless for 
application software unless the OS is fixed.  With FF/Tb etc, this isn't 
the case.

The right place to solve the RN issue is in the OS.  Linux, etc. As far 
as the application (FF/Tb/etc) is concerned, the random numbers should 
be sourced from the platform, and they should punt the entire problem to 
the platform [1].

That's not to say it's uninteresting - it's an intensely interesting 
problem.  But the problem is so intricate that it is taking us a while 
to figure out where to place the components. From the position of a 
hardware supplier of RNG devices, what you want is to write the RNs into 
/dev/random.

Going forward, it would be nice if there were a standard way for a RN to 
pop up on the bus and announce its ability to deliver RNs.  That would 
make the path so much more obvious.  But for that to happen we probably 
have to go through a Cambrian explosion of generators.

iang

[1] http://iang.org/ssl/hard_truths_hard_random_numbers.html



On 31/12/2016 20:28, aweatherguy wrote:
> Best wishes to all in 2017!
>
> I'm new to the list and have a very narrow topic to inquire about. 
> I've been working on an inexpensive TRNG (True Random Number 
> Generator) and am interested in having Firefox/Thunderbird use this as 
> a source for TLS key generation, instead of the built-in PRNG 
> (Pseudo-Random Number Generator).
>
> I seem to have custom builds of both Firefox and Thunderbird working 
> with the TRNG now. The changes were pretty small and easy. What I'm 
> wondering is if anyone on this list would be interested in integrating 
> this capability into these products. Or maybe this is beyond the scope 
> of your products?
>
> I'm sure that one pre-requisite is cost. The TRNG is an off-the-shelf 
> Arduino Uno -- meaning the hardware is withing financial reach of most 
> folks. The Arduino firmware could be open-source (probably GPL). If 
> you're wondering, I'm not associated with Arduino in any way and would 
> not benefit financially were this idea to become popular.
>
> I've avoided including much detail here as this is just an initial 
> inquiry to gauge your interest.
>
> Cheers,
>
>     aweatherguy
>
>
> _______________________________________________
> dev-security mailing list
> [email protected]
> https://lists.mozilla.org/listinfo/dev-security