Creating Entropy For Cryptographic Purposes

[StarHunter]

TL;DR Summary

This topic touches on certain aspects of exploring entropy generating devices used to create information from energy.

Hello,

My name is Mason C. Turner and I work in the cybersecurity field. My background includes both military communications as well as private sector experience.

According to the laws of physics, to the best of my understanding information and energy are directly interchangeable in a theoretical sense but any useable energy source contains inherent information. Such at the wavelength of the energy, interference, amplitude and modulation. My question is what would be your go to theoretical mechanism to generate the highest entropy possible using current day technology?

I am happy to learn about current day methods and theoretical mechanisms. For example, Cloudflare uses its "wall of entropy" which is dependent on a temperature, and then so, through advanced analysis, large data collection can be used to create an entropy baseline. It seems like the current solution is to use what seems to be random events in order to create an entropy source. I am open to critics and other input.

Respectfully,

Mason C. Turner

 

[dirichlet]

I am not sure if this is what you are looking for.

In digital architectures, jitter of ring oscillators (ROs) are popular sources for entropy.
You can get an introduction about ROs here:
https://en.wikipedia.org/wiki/Ring_oscillator
ROs for hardware TRNGs are actively being researched.

Also:

The FRO-based TRNGs are very popular due to their use of the standard digital logic despite issues with randomness proofs and chip-to-chip variability.

Source: https://en.wikipedia.org/wiki/Hardware_random_number_generator#Free-running_oscillators-based_RNG

Cloudflare's method of creating entropy is similar to the Lavarand method:
https://en.wikipedia.org/wiki/Lavarand

 

[f95toli]

Quantum random number generators. These are already commercially available in the form of rack-mountable equipment. There are online resources that allow you to try them out (online resources can for obvious reasons not be used in actual security applications).

QRNGs are theoretically perfect, but for-real world hardware there a whole bunch of tests that they must pass to ensure that they actually work as intended (there are now organisations that can perform these tests)

 

[Vanadium 50]

A good question is who you are trying to keep out of your stuff: your little sister, or major world governments? That tells you how much effort one should reasonably put into this.