166
D. Hurley-Smith and J. Hernandez-Castro
most PRNG algorithms are periodically re-seeded from a natural source of entropy.
The primary benefit of PRNGs is that they are usually extremely fast, especially
when compared to the natural entropy sources used to seed them. This makes them
highly attractive for use in computer systems, and in applications requiring highvolume RNG.
Physical sources of entropy can provide what is referred to as true randomness.
True Random Number Generators (TRNG) use a broad array of different entropy
sources as their key component but share several common characteristics. They
do not require seeding to generate randomness and use a natural phenomenon as
their entropy source. TRNGs can be classified further, as classical or Quantum
Random Number Generators (QRNGs). To simplify matters, TRNG will refer to
classical methods, and QRNG will refer to quantum methods from this point. TRNG
utilize microscopic phenomena that generate statistically random noise signals. The
photoelectric effect and thermal noise are two examples of classical entropy sources.
QRNG operate on similar principles but instead make use of quantum phenomena.
These include photon-counting, using a beam-splitter, or the observation of quantum
shot-noise in MOS/CMOS devices.
All random number generators can be evaluated using statistical test batteries.
Dieharder, Federal Information Processing Standard (FIPS) 140-1/2, and National
Institute of Standards and Technology (NIST) SP800-22 [448] represent the three
most common test batteries used for professional testing of random number generators. Manufacturers often use such tests to demonstrate the correct functioning
of their products, but they are also used by third-parties to independently verify the
randomness of a device. NIST and Common Criteria [407] provide guidelines and
tests that have been independently developed to ascertain whether an RNG is nonrandom. These tests evaluate RNGs by identifying whether there is any observable
bias, structure or predictability in an RNG’s output. It is not possible to identify
randomness, but non-randomness can be detected. Certification schemes make use
of such tests to publicly acknowledge the robustness of computational security
systems. Specific methodologies have been devised to guide and ensure the quality
of these evaluations in the area of RNG validation.
Significant trust is placed in statistical testing to determine whether an RNG
provides sufficiently random output. The aim of this chapter is to demonstrate
that the challenges of statistical testing of randomness are far from solved. We
evaluate a selection of contemporary TRNG to highlight issues in data collection,
test correlation and the overuse of older test batteries to the exclusion of newer tests.
As minuscule, integrated TRNG become more prolific through their use in Internet
of Things (IoT) products, these considerations become all the more important.
The following sections discuss, in order: certification of RNGs and the standards/testing procedures that apply, the challenges faced during the collection of
data from RNGs, and two sets of experimental results demonstrating issues in the
appropriate selection of statistical tests for RNG evaluation.
D. Hurley-Smith and J. Hernandez-Castro
most PRNG algorithms are periodically re-seeded from a natural source of entropy.
The primary benefit of PRNGs is that they are usually extremely fast, especially
when compared to the natural entropy sources used to seed them. This makes them
highly attractive for use in computer systems, and in applications requiring highvolume RNG.
Physical sources of entropy can provide what is referred to as true randomness.
True Random Number Generators (TRNG) use a broad array of different entropy
sources as their key component but share several common characteristics. They
do not require seeding to generate randomness and use a natural phenomenon as
their entropy source. TRNGs can be classified further, as classical or Quantum
Random Number Generators (QRNGs). To simplify matters, TRNG will refer to
classical methods, and QRNG will refer to quantum methods from this point. TRNG
utilize microscopic phenomena that generate statistically random noise signals. The
photoelectric effect and thermal noise are two examples of classical entropy sources.
QRNG operate on similar principles but instead make use of quantum phenomena.
These include photon-counting, using a beam-splitter, or the observation of quantum
shot-noise in MOS/CMOS devices.
All random number generators can be evaluated using statistical test batteries.
Dieharder, Federal Information Processing Standard (FIPS) 140-1/2, and National
Institute of Standards and Technology (NIST) SP800-22 [448] represent the three
most common test batteries used for professional testing of random number generators. Manufacturers often use such tests to demonstrate the correct functioning
of their products, but they are also used by third-parties to independently verify the
randomness of a device. NIST and Common Criteria [407] provide guidelines and
tests that have been independently developed to ascertain whether an RNG is nonrandom. These tests evaluate RNGs by identifying whether there is any observable
bias, structure or predictability in an RNG’s output. It is not possible to identify
randomness, but non-randomness can be detected. Certification schemes make use
of such tests to publicly acknowledge the robustness of computational security
systems. Specific methodologies have been devised to guide and ensure the quality
of these evaluations in the area of RNG validation.
Significant trust is placed in statistical testing to determine whether an RNG
provides sufficiently random output. The aim of this chapter is to demonstrate
that the challenges of statistical testing of randomness are far from solved. We
evaluate a selection of contemporary TRNG to highlight issues in data collection,
test correlation and the overuse of older test batteries to the exclusion of newer tests.
As minuscule, integrated TRNG become more prolific through their use in Internet
of Things (IoT) products, these considerations become all the more important.
The following sections discuss, in order: certification of RNGs and the standards/testing procedures that apply, the challenges faced during the collection of
data from RNGs, and two sets of experimental results demonstrating issues in the
appropriate selection of statistical tests for RNG evaluation.