Add More Entropy Sources and Checks for Random Generation - #145
Merged
Conversation
…apture Estimates describe the observed distribution, not cryptographic entropy, so dice pairs the histogram estimate with consecutive-difference pattern check and the camera folds the hardware RNG into the frame digest - hashed rather than XOR-ed, so an RNG that could observe the frame still cannot steer the result. Dice deliberately stays reproducible: the user must be able to verify that derivation off-device.
The void return left failure structurally invisible: pin.c and nvs_secure.c fill an uninitialized key[32] and burn it straight into eFuse, so a silent no-op would permanently provision a key made of stack garbage. Returning a status under KERN_WARN_UNUSED_RESULT makes the compiler reject any caller that ignores it. The all-zero health check catches a dead RNG, which is otherwise indistinguishable from a valid draw at the call sites that matter most.
Defense in depth behind the hardware RNG, fed by touch timing and camera sensor noise. Folding it in by hashing rather than XOR means it can only add: a worthless or attacker-known pool leaves the output exactly as strong as the RNG alone, so this is never a reason to skip the SAR ADC source. The all-zero health check stays ahead of the mix, since hashing first would make a dead RNG undetectable. Extraction ratchets the pool so a later compromise cannot recover the state behind bytes already handed out; stirring stays a rotate-XOR because it runs on every camera frame.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
feat(entropy)— Entropy checks. Dice pairs a histogram estimate against a 128/256-bit target with consecutive-difference pattern check; camera gates snapshots at 5.0 bits/pixel. Both are explicitly labelled estimates of the observed distribution, not cryptographic entropy. A uniform-but-cyclic dice sequence passes the entropy check and is caught only by the pattern check.fix(crypto)— Enable the SAR ADC entropy source around RNG reads, Although ESP-IDF'srandom.rstclaims the opposite for chips without RF. Bracketing insidecrypto_random_bytes()covers every consumerfix(crypto)— Makecrypto_random_bytesfailures detectable. It returnedvoid, so failure was structurally invisible —pin.candnvs_secure.cfill an uninitializedkey[32]and burn it straight into eFuse. Now returns a status underKERN_WARN_UNUSED_RESULT, so the compiler rejects any caller that ignores it, plus an all-zero health check for a dead RNG.feat(crypto)— Auxiliary entropy pool fed by touch timing and camera sensor noise, folded intocrypto_random_bytesby hashing so it can only ever add. Extraction ratchets the pool; stirring stays a rotate-XOR because it runs on every camera frame.