Re: Happy New Year!

Just to respond to some of these points because you raise good 
questions, but thinking has moved on in the last decade or so.


On 02/01/2017 08:22, Martin Heaps wrote:
> On Sunday, 1 January 2017 01:29:33 UTC, aweatherguy  wrote:
>> Best wishes to all in 2017!
>>
>> I'm new to the list and have a very narrow topic to inquire about. I've
>> been working on an inexpensive TRNG (True Random Number Generator) and
>> am interested in having Firefox/Thunderbird use this as a source for TLS
>> key generation, instead of the built-in PRNG (Pseudo-Random Number
>> Generator).
>>
> My first reaction is that an inexpensive TRNG is a bit like building a cheap skyscrapper. Yes it can exist, but it will not be of great benefit due to the shortcoming required to make it "inexpensive".
>
> 1) How will you know the numbers generated are truly random?
>
> 2) There is a point of view that truly random numbers are impossible, as one a tiny subset of numbers are truly random and therefore they are more predictable than Pseudo-random. This is (if memory serves me) a basis of Chaos Theory (that chaos is predictable because it's not predictable).

We don't (any more) think about random numbers.  What we think about is 
numbers that are unknown to the adversary.  This solves a number of 
issues due to the sort of rabbit holes you outline.  It's a much more 
practical engineering challenge to find numbers unknown to an adversary.

Now, perversely, given your above skyscraper comment, it turns out that 
the go-to solution for numbers unknown to the adversary is several 
cheap&dirty generators that are mixed then whitened. E.g., take 64 bytes 
from 3 different independent crappy sources, concatenate them, feed them 
as a key into a stream cipher.  Done.

>> I seem to have custom builds of both Firefox and Thunderbird working
> with the TRNG now. The changes were pretty small and easy
>
> If changes were 'small and easy' have you considered if there's a reason why someone else has not already done this?

Yup - Mozilla's meme is not to resolve the RN issue but to put pressure 
on the platforms to do so.

iang