Hardware Random Number Generator

Computers are machines that stubbornly calculate according to rules. That is precisely why true randomness is difficult for them: anyone who knows the rule and the starting value can recalculate every result. A hardware random number generator solves this problem differently. It measures a physical process that is inherently irregular and converts the measured values into zeros and ones. Typical sources are tiny voltage fluctuations in an electronic component caused by heat, or the decay of radioactive atoms. According to current physical knowledge, such processes cannot be calculated, only observed.

Why poor randomness makes passwords crackable

Almost every encryption on the internet begins with a random number. When your phone establishes a secure connection to a bank, it rolls the dice for a secret key. If this die is manipulated or too predictable, the key is worthless. An attacker then doesn’t need to try billions of possibilities, just the few that the generator can actually produce.

Such cases have really happened. In 2008, a developer accidentally removed a source of randomness from widely used encryption software. After that, there were only around 32,000 different possible keys left. A normal PC could try them all in a short time. Thousands of servers were affected, even though nothing was wrong with the encryption itself.

That is why randomness is treated as its own critical resource in security technology. Lotteries, gambling machines, and scientific simulations also depend on it. In the case of lotteries, there is an additional need for provability: no one should later be able to claim that the outcome was known in advance.

From noise to zeros and ones

A hardware random number generator usually consists of three parts. First comes the source, for example a resistor, in which electrons move irregularly due to heat. This movement produces a tiny, fluctuating voltage, known as thermal noise. An amplifier makes this signal large enough to be measured.

Digitization follows next. At rapid intervals, the device checks whether the voltage is above or below a threshold and writes a one or a zero. Raw noise is almost never perfectly balanced. Perhaps 51 percent ones and 49 percent zeros come out, or consecutive bits are slightly correlated.

That is why there is a third step, post-processing. It uses a mathematical procedure to recalculate the raw bits so that the bias disappears. From many slightly skewed raw bits, fewer but cleaner output bits are produced. Good generators additionally monitor themselves and shut down if the noise suddenly becomes suspiciously regular. This can happen if someone strongly cools the chip or bombards it with radio waves to influence it.

The random chip in the phone and in the data center

Practically every modern device has such a generator built in. Intel and AMD processors offer a dedicated instruction for this called RDRAND. Smartphones, bank cards, and the chip in national ID cards also possess a physical source of randomness. Operating systems mix its output with other unpredictable values, such as the time intervals between keystrokes.

It is important to distinguish this from a pseudorandom number generator. This calculates numbers from a starting value and, given the same starting value, always delivers the same sequence. For computer games or statistics, this is entirely sufficient and even practical, because results can be reproduced. In practice, the two are combined: the hardware generator supplies the secret starting value, and the pseudorandom generator quickly produces large quantities of bits from it.

In the news, hardware random number generators mainly come up in connection with two topics. First, security vulnerabilities, when a generator has delivered too little randomness or authorities are suspected of having weakened it. Second, quantum technology: quantum random number generators use individual light particles and are considered especially well-justified, because their unpredictability follows directly from physical laws.